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March  7,2013 

MEMORANDUM  FOR  DIRECTOR,  DEFENSE  CONTRACT  AUDIT  AGENCY 

SUBJECT:  Monitoring  of  the  Quality  of  the  Defense  Contract  Audit  Agency  FY  2010  Audits 
(Report  No.  DODIG-20 13-044) 

We  are  providing  this  report  for  review  and  comment.  The  completion  of  this  report  was 
delayed  due  to  a  shift  in  our  primary  oversight  of  DC AA  to  reviewing  Defense  Hotline 
complaints  during  the  period  of  January  2010  through  January  2012. 

We  found  that  the  Defense  Contract  Audit  Agency  (DCAA)  did  not  exercise  professional 
judgment  in  performing  37  (74  percent)  of  the  50  FY  2010  assignments  reviewed.  DCAA 
performed  much  of  the  field  work  on  the  reviewed  assignments  prior  to  FY  2010  and  since  FY 
2009  has  taken  various  corrective  actions  to  address  deficiencies  identified  in  our  review.  This 
report  acknowledges  DCAA  corrective  actions  and  includes  additional  recommendations 
intended  to  improve  audit  quality.  We  will  evaluate  the  effectiveness  of  DCAA  corrective 
actions  in  the  future.  Additionally,  we  will  evaluate  the  current  DCAA  system  of  quality  control 
for  audits  as  a  part  of  our  upcoming  peer  review. 

We  considered  management  comments  on  a  draft  of  this  report  when  preparing  the  final 
report.  Comments  provided  by  DCAA  were  partially  responsive.  DoD  Directive  7650.3 
requires  that  recommendations  be  resolved  promptly.  We  request  that  DCAA  provide  additional 
comments  for  Recommendations  9.b,  1  l.a,  1  l.b,  1  l.c,  13,  16,  and  17.  We  should  receive  the 
comments  by  April  5,  2013. 

If  possible,  send  an  Adobe  Acrobat  pdf  file  containing  your  comments  to  either  e-mail 
address  provided  below.  Copies  of  your  comments  must  have  the  actual  signature  of  the 
authorizing  official  for  your  organization.  We  are  unable  to  accept  the  /Signed/  symbol  in  place 
of  the  actual  signature. 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  or 
Carolyn  R.  Davis  at  (703)  604-8877  (DSN  664-8877),  Carolyn.Davis@dodig.mil  or 
Ms.  Diane  H.  Stetler  at  (703)  604-8737  (DSN  664-8737),  Diane.Stetler@dodig.mil.  If  you 
desire,  we  will  provide  a  formal  briefing  on  the  results. 
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Results  in  Brief:  Monitoring  of  the  Quality  of 
the  Defense  Contract  Audit  Agency  FY  2010 
Audits 


What  We  Did 

We  performed  quality  assurance  reviews  on  50 
Defense  Contract  Audit  Agency  (DCAA) 
reports  issued  during  the  first  half  of  FY  2010. 
We  evaluated  assignments  from  all  five  DCAA 
regions  and  the  Field  Detachment  to  detennine 
compliance  with  government  auditing  standards 
and  DCAA  policies  and  procedures.  The 
completion  of  this  report  was  substantially 
delayed  due  to  the  shift  in  our  primary  oversight 
of  DCAA  from  reviews  of  audit  quality  to  the 
review  of  hotlines  during  the  period  January 
2010  through  January  2012. 

What  We  Found 

DCAA  did  not  exercise  professional  judgment 
in  performing  37  (74  percent)  of  the  50  FY  2010 
assignments  reviewed.  DCAA  performed  much 
of  the  field  work  on  the  reviewed  assignments 
prior  to  FY  2010.  The  abundance  of  non- 
compliances  with  standards  identified  in  the  37 
assignments  evidenced  the  need  for 
improvements  in  the  area  of  competence  at 
DCAA. 


Significant  quality  issues  identified  included 
external  impairments  to  independence, 
inadequate  planning,  poor  communications  with 
the  requester  and  contractor,  insufficient 
evidence,  unsupported  or  untimely  reports,  poor 
documentation,  and  ineffective  supervision  and 
quality  control.  DCAA  stated  that  the  reviewed 
assignments  could  still  evidence  the  residual 
effects  of  the  production-oriented  environment 
that  previously  existed.  Since  FY  2009,  DCAA 
has  taken  various  corrective  actions  such  as 
revising  training  class  curriculums,  requiring 
additional  training  for  all  audit  staff,  and 
revamping  audit  programs  and  guidance.  We 
will  evaluate  the  effectiveness  of  these  actions 
during  future  reviews. 

What  We  Recommend 

We  recommend  that  DCAA  consider  rescinding 
or  supplementing  certain  reports,  and  taking 
other  appropriate  actions  on  the  37  assignments. 
We  also  recommend  that  DCAA  reassess 
various  policies,  procedures,  and  training  and 
revise  them,  as  appropriate,  to  improve  audit 
quality  and  compliance  with  government 
auditing  standards. 

Management  Comments  and 
Our  Response 

DCAA  management  comments  were  generally 
responsive.  DCAA  considers  corrective  actions 
completed  on  17  recommendations.  Based  on 
management  comments,  we  deleted  draft 
Recommendation  4  and  revised  draft 
Recommendation  12. a,  now  11. a.  We  also 
clarified  three  findings.  We  request  that  DCAA 
provide  additional  comments  on  7 
recommendations.  Please  see  the 

recommendations  table  on  the  back  of  this  page. 
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Recommendations  Table 


March  7,2013 


Management 

Recommendations 
Requiring  Comment 

No  Additional  Comments 
Required 

Director,  Defense  Contract 
Audit  Agency 

9.b,  11. a,  1  l.b,  ll.c,  13,  16,  17 

l.a,  l.b,  l.c,  2,  3,  4. a,  4.b,  4.c, 

5,  6,  7,  8,  9. a,  9.c,  10,  ll.d, 

12. a,  12. b,  12. c,  14,  15 

Please  provide  comments  by  April  5,  2013. 
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Introduction 


Objectives 

We  conducted  this  review  to  determine  whether  attestation  engagements1  and 
perfonnance  audits2  performed  by  the  Defense  Contract  Audit  Agency  (DCAA)  in 
FY  2010  complied  with  generally  accepted  government  auditing  standards  (GAGAS), 
applicable  DoD  policies,  and  DCAA  policies  and  procedures.  We  reviewed 
47  examination  engagements,  2  agreed-upon  procedures  engagements,  and 
1  perfonnance  audit.  This  amounts  to  a  total  of  50,  with  reports  issued  from 
October  1,  2009  through  March  31,  2010.  We  will  use  the  review  results  of  FY  2010 
assignments3  as  a  baseline  to  measure  future  improvements  in  DCAA  audit4  quality.  See 
Appendix  A  for  a  discussion  of  our  scope  and  methodology. 

Background 

Defense  Contract  Audit  Agency 

DCAA  Charter.  In  1965,  DCAA  was  fonned  to  provide  a  single  contract  audit 
capability  within  the  Department  of  Defense.  DoD  Directive  5 105.36,  “Defense  Contract 
Audit  Agency,”  provides  the  mission,  organization  and  management,  responsibilities  and 
functions,  relationships,  and  authorities  of  DCAA.  DCAA  is  a  Defense  agency  under  the 
direction,  authority,  and  control  of  the  Under  Secretary  of  Defense  (Comptroller)/Chief 
Financial  Officer.  The  primary  mission  of  DCAA  is  to  perform  contract  audits  for  DoD. 
DCAA  also  provides  accounting  and  financial  advisory  services  regarding  contracts  and 
subcontracts  to  DoD  Components  responsible  for  procurement  and  contract 
administration.  In  addition,  DCAA  perfonns  contract  audit  services  for  non-DoD  Federal 
organizations  on  a  reimbursable  basis,  as  appropriate.  DCAA  performs  the  majority  of 
its  work  (88.25  percent  of  hours  charged  to  assignments  perfonned  under  GAGAS)  as 


1  Attestation  engagement  is  one  of  the  three  categories  that  the  Comptroller  General  of  the  United  States- 
issued  generally  accepted  government  auditing  standards  requirements  apply  to.  Attestation  engagements 
can  cover  a  broad  range  of  financial  or  nonfinancial  objectives  and  may  provide  different  levels  of 
assurance  about  the  subject  matter  or  an  assertion  depending  on  the  user’s  needs.  Attestation  engagements 
result  in  an  examination,  a  review,  or  an  agreed-upon  procedures  report  on  a  subject  matter  or  on  an 
assertion  about  a  subject  matter  that  is  the  responsibility  of  another  party. 

2  Performance  audit  is  another  of  the  three  categories  that  the  generally  accepted  government  auditing 
standard  requirements  apply  to.  GAGAS  1 .25  defines  performance  audits  as  “ . . . engagements  that  provide 
assurance  or  conclusions  based  on  an  evaluation  of  sufficient,  appropriate  evidence  against  stated  criteria, 
such  as  specific  requirements,  measures,  or  defined  business  practices.” 

3  The  term  ‘audit  assignment’  is  defined  by  DCAA  as  “. . .  the  authorization  to  perform  a  particular  phase  or 
aspect  of  the  contract  audit  responsibility  at  a  specific  contractor.”  DCAA  establishes  assignment  numbers 
in  its  management  information  system  to  track  individual  projects  being  performed  by  the  audit  staff. 

4  DCAA  uses  the  term  ‘audit’  to  refer  to  individual  assignments  and  considers  it  as  referring  to  a  variety  of 
types  of  evaluations  of  various  types  of  data  by  a  person  other  than  the  preparer  of  the  data.  To  improve 
report  readability,  this  report  uses  the  term  ‘audit’  to  refer  to  an  examination  engagement  when  discussing 
the  quality  of  work  performed  under  GAGAS. 
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examination5  engagements.  DCAA  also  conducts  some  agreed-upon  procedures  6 
engagements  and  a  limited  number  of  performance  audits  that  are  conducted  as 
operations  audits.  In  FY  2010,  DCAA  issued  1 1,610  reports  covering  $228  billion. 
Additional  infonnation  on  DCAA  work  is  provided  in  Table  1  below. 


Table  1.  FY  2010  DCAA  Statistics 


Type  of 
Assignment 

Number  of 
Reports 

Dollars 

Examined 

(000s) 

Questioned 

Costs 

(000s) 

Hours 

Charged 

Operations 

Audits 

25 

$0 

$325,025 

25,479 

Incurred  Cost 

1,634 

33,459,535 

137,685 

806,388 

Internal  Controls 

533 

0 

0 

187,366 

Special  Audits 

3,112 

8,147,334 

832,011 

688,960 

Cost  Accounting 
Standards 

916 

946,270 

40,419 

254,788 

Forward  Pricing 

5,331 

185,060,882 

12,267,786 

1,325,704 

Defective  Pricing 

59 

0 

53,747 

38,009 

Totals 

11,610 

$227,614,021 

$13,656,673 

3,326,694 

DCAA  Organization  and  Functions.  In  FY  2012,  DCAA  had  approximately 
4,725  employees  located  in  1 16  field  offices  throughout  the  United  States,  Europe,  the 
Pacific,  and  Southwest  Asia.  DCAA  consists  of  headquarters,  five  regions,  and  Field 
Detachment  (for  classified  audits).  Regional  directors  are  responsible  for  planning, 
managing,  and  accomplishing  the  DCAA  mission  in  assigned  geographical  areas, 
including  personnel  and  resources  in  the  individual  regional  offices  and  various  field 
audit  offices  within  their  region.  The  Field  Detachment  director  has  the  same 
responsibility  for  worldwide  DCAA  contract  audits  of  compartmented  programs  and  the 
personnel  and  resources  assigned  to  Field  Detachment.  DCAA  audits  forward  pricing 
proposals  submitted  by  contractors  and  subcontractors  in  connection  with  award, 
administration,  modification,  or  re-pricing  of  Government  contracts.7  DCAA  audits  also 
help  contracting  officers  detennine  the  adequacy  of  a  contractor’s  estimating,  budgeting, 
billing,  and  accounting  systems.  In  addition,  DCAA  audits  for  compliance  with  cost 
accounting  standards  and  disclosed  accounting  practices;  and  allowability  of  incurred 
costs  charged  to  the  Government  in  accordance  with  the  Federal  Acquisition  Regulation 
and  the  Defense  Federal  Acquisition  Regulation  Supplement. 


5  An  examination  engagement  or  examination  provides  positive  assurance.  GAGAS  1.23a  states  that  an 
examination  “...[cjonsists  of  obtaining  sufficient,  appropriate  evidence  to  express  an  opinion  on  whether 
the  subject  matter  is  based  on  (or  in  conformity  with)  the  criteria  in  all  material  respects  or  the  assertion  is 
presented  (or  fairly  stated),  in  all  material  respects,  based  on  the  criteria.” 

6  GAGAS  1.23c  states  that  an  agreed-upon  procedures  engagement  or  agreed-upon  procedures 
“...[cjonsists  of  specific  procedures  performed  on  a  subject  matter.” 

7  Forward  pricing  proposals  assignments  are  audits  of  estimated  future  costs  of  proposed  contractor  pricing, 
proposed  contract  change  orders,  costs  for  re-determinable  fixed-price  contracts,  and  costs  incurred  but  not 
yet  covered  by  definitized  contracts. 
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Generally  Accepted  Government  Auditing  Standards 

DoD  Instruction  7600.02  dated  April  27,  2007,  “Audit  Policies,”  requires  that  all 
independent  audit  and  attestation  engagements  of  DoD  organizations,  programs, 
activities,  and  functions  be  conducted  in  accordance  with  GAGAS  as  issued  by  the 
Comptroller  General  of  the  United  States.  GAGAS  provides  the  framework  for  auditors 
to  perform  high-quality  audit  work  with  competence,  integrity,  objectivity,  and 
independence.  The  standards  require  auditors  to  exercise  professional  judgment  in 
planning  and  performing  audits  and  attestation  engagements,  and  in  reporting  the  results. 
GAGAS  includes  ethical  principles;  general  standards;  field  work  and  reporting 
Standards  for  Financial  Audits;  General,  Field  Work,  and  Reporting  Standards  for 
Attestation  Engagements;  and  Field  Work  and  Reporting  Standards  for  Performance 
Audits  sections.  For  attestation  engagements,  GAGAS  incorporates  the  American 
Institute  of  Certified  Public  Accountants  (AICPA)  general  standard  on  criteria,  the  field 
work  and  reporting  standards,  and  related  Statements  on  Standards  for  Attestation 

o 

Engagements  [SSAE]  unless  specifically  excluded  or  modified.  GAGAS  also 
establishes  additional  field  work  and  reporting  standards  for  attestation  engagements. 

GAG AS-Required  Peer  Review 

Since  August  26,  2009,  DCAA  has  not  had  an  opinion  on  its  quality  control  system 
covering  DCAA  audits  and  attestation  engagements  as  required  by  GAGAS  3.59b. 
GAGAS  3.50b  and  3.55  require  audit  organizations  perfonning  audits  or  attestation 
engagements  in  compliance  with  GAGAS  to  have  an  external  peer  review  at  least  once 
every  3  years.  Based  on  the  criteria,  DCAA  should  have  obtained  a  peer  review  on  its 
work  performed  in  FY  2009. 

We  perfonned  the  last  peer  review  on  DCAA  audit  and  attestation  engagement  reports 
issued  in  FY  2006.  We  issued  Report  No.  D-2007-6-006,  “Review  of  the  Defense 
Contract  Audit  Agency  Quality  Control  System,”  on  May  1,  2007.  We  concluded  that 
the  DCAA  system  of  quality  control  used  on  audits  and  attestation  engagements  for  the 
review  period  ended  September  30,  2006,  was  adequate.  The  report  identified  several 
concerns  or  areas  that  DCAA  needed  to  improve  in  to  comply  with  GAGAS  while 
conducting  engagements. 

•  Incurred  cost  desk  reviews  should  not  have  been  perfonned  as  review 
engagements.8 9 

•  Contract  audit  closing  statement  assignments  performed  using  standard  programs 
did  not  gather  sufficient  evidence  to  meet  the  GAGAS  requirements  for 
examination  engagements. 


8  The  2007  revision  to  GAGAS,  did  not  exclude  any  field  work  standards,  reporting  standards,  or 
Statements  on  Standards  for  Attestation  Engagements. 

9  GAGAS  1.23b  states  that  review  engagements  consist  of  sufficient  testing  to  express  a  conclusion  about 
whether  any  information  came  to  the  auditors’  attention  based  on  the  work  performed  that  indicates  the 
subject  matter  is  not  based  on  (or  not  in  conformity  with)  the  criteria  or  the  assertion  is  not  presented  fairly 
(or  not  stated  fairly)  in  all  material  aspects  based  on  the  criteria.  This  is  also  known  as  providing  negative 
assurance. 
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•  Agreed-upon  procedures  engagements  did  not  comply  with  applicable  standards 
regarding  requester  responsibility  for  procedures;  proper  definition  of  criteria; 
appropriate  definition  of  procedures;  and  reporting  requirements. 

•  Specific  criteria  used  in  the  working  papers  or  in  the  associated  report  were  not 
properly  identified. 

•  Steps  were  not  designed  to  provide  reasonable  assurance  of  detecting  fraud, 
illegal  acts,  or  violations  of  contract  provisions. 

•  Sampling  plans  for  nonstatistical  and  statistical  samples  were  not  adequately 
documented. 

•  DCAA  reports  did  not  fully  disclose  or  describe  the  use  of  statistical  or 
nonstatistical  sampling  plans. 

The  report  also  informed  DCAA  that  continued  and  repeated  noncompliances  identified 
during  its  internal  quality  assurance  reviews  could  indicate  significant  deficiencies  in  the 
DCAA  quality  control  system  and  could  negatively  impact  the  overall  peer  review 
opinion  in  future  peer  reviews. 

On  August  24,  2009,  we  notified  DCAA  that  our  opinion  would  no  longer  apply  to  the 
DCAA  system  of  quality  control.  This  action  resulted  from  our  significant  findings 
described  above  coupled  with  the  results  of  the  July  2009  Government  Accountability 
Office  (GAO)  draft  report,  “DCAA  Audits:  Widespread  Problems  with  Audit  Quality 
Require  Significant  Reform”  (GAO-09-468).  After  August  26,  2009,  all  DCAA  reports 
identified  as  being  in  compliance  with  GAGAS  should  have  contained  a  modified 
GAGAS  statement  noting  an  exception  to  compliance  with  the  Quality  Control  and 
Assurance  standard  until  a  new  DCAA  peer  review  report  is  issued. 

In  FY  2012,  with  the  assistance  of  the  Council  of  Inspectors  General  on  Integrity  and 
Efficiency  (CIGIE)  Audit  Committee,  DCAA  started  the  process  of  obtaining  an  outside 
firm  to  perform  its  next  peer  review.  DCAA  stated  that  the  peer  review  is  to  be 
performed  in  FY  2013  and  cover  reports  issued  in  FY  2012. 

Impact  of  DCAA  Corrective  Actions  from  Prior  Reviews  on 
Reviewed  FY  2010  Assignments 

Prior  GAO  and  DOD  Inspector  General  (IG)  reviews  of  DCAA  reports  identified 
significant  deficiencies  in  audit  work,  including  poor  supervision,  inadequate 
documentation,  inappropriate  changes  to  report  opinions,  and  lack  of  sufficient  testing  to 
support  report  opinions.  To  address  audit  quality  issues,  DCAA  implemented  various 
corrective  actions  such  as  revised  supervisory  training;  a  required  computer-based 
training  course  on  working  paper  documentation;  required  training  on  GAGAS; 
revamped  audit  programs;  and  issuance  of  revised  guidance  on  variable  and  attribute 
sampling  with  relevant  training  modules.  DCAA  had  not  completed  all  of  its  planned 
corrective  actions  in  time  to  impact  work  performed  prior  to  FY  2009.  DCAA  performed 
most  of  the  field  work  on  the  engagements  we  reviewed  prior  to  FY  2009  even  though 
DCAA  issued  the  reports  in  FY  2010. 
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DOD  IG  Continuous  Monitoring  ofDCAA  Audit  Activities 

The  Inspector  General  Act  of  1978,  as  amended,  Sections  4(a)(1)  and  8(c)(6),  direct  the 
DOD  IG  to  develop  policy,  evaluate  program  performance,  and  monitor  and  evaluate 
DoD  auditor  compliance  with  internal  audit,  contract  audit,  and  internal  review 
principles,  policies,  and  procedures.  To  carry  out  these  responsibilities  on  DCAA  audit 
activities,  the  Office  of  the  Assistant  Inspector  General  for  Audit  Policy  and  Oversight 
perfonns  oversight  reviews  of  high-risk  DCAA  audit  areas  and  quality  assurance 
evaluations  ofDCAA  attestation  engagements  and  audits.  We  also  conduct  various 
ongoing  activities  covering  DCAA  that  include  monitoring: 

•  training, 

•  implementation  of  agreed-to  corrective  actions, 

•  draft  or  final  contract  audit  policy  issuances, 

•  results  from  DCAA  internal  quality  assurance  reviews,  and 

•  results  ofDCAA  internal  review  directorate  evaluations. 

General  Standards 

Professional  Judgment 

Failure  to  Exercise  Sufficient  Professional  Judgment 

In  37  of  the  50  assignments  (74  percent)  reviewed,  the  audit  staff10  did  not  exercise 
professional  judgment  as  evidenced  by  deficiencies  identified  in  multiple  standards  areas. 
The  37  assignments  had  a  high  number  of  deficiencies,  ranging  from  6  to  9  deficiencies 
out  of  9  standards  areas  excluding  professional  judgment.  Table  2  summarizes  the 
deficiencies  identified  by  each  region  and  Field  Detachment.  Appendix  B  summarizes 
the  results  by  individual  assignment.  Both  tables  and  the  following  report  sections  on 
individual  standards  demonstrate  a  pattern  of  noncompliance  spread  among  all  regions 
and  Field  Detachment,  and  among  all  engagement  types. 


10  Audit  staff  includes  all  DCAA  employees  categorized  in  the  Government  0511  Auditor  job  series  and, 
for  purposes  of  this  report  section,  includes  auditors  assigned  to  the  audit  office,  supervisory  auditors,  audit 
office  managers,  auditors  assigned  to  regions  and  headquarters,  and  regional  or  detachment  audit  managers 
who  worked  on  the  reviewed  assignments. 


5 


Table  2.  Number  of  Noncompliances  Identified  by  Region  or  Field  Detachment  for 


Each  Overall  Standard  Assessed 


Standard 

Central 

Region 

Eastern 

Region 

Northeastern 

Region 

Mid- 

Atlantic 

Region 

Western 

Region 

Field 

Detachment 

Total  No. 
Assignments 
Not  Meeting 
Standards 

Professional 

Judgment 

5 

5 

8 

7 

8 

4 

37 

Independence 

1 

2 

- 

2 

- 

- 

5 

Competence 

- 

- 

- 

1 

2 

2 

5 

Quality 

7 

8 

9 

8 

9 

5 

46 

Planning 

6 

5 

6 

6 

7 

4 

34 

Communication 

9 

9 

9 

9 

9 

5 

50 

Evidence 

6 

5 

8 

8 

8 

4 

39 

Documentation 

5 

5 

7 

6 

7 

4 

34 

Supervision 

6 

6 

8 

8 

9 

4 

41 

Reporting 

5 

5 

8 

7 

8 

4 

37 

Our  review  results  indicate  a  higher  rate  of  noncompliance  with  professional  judgment 
standards  than  the  FY  2010  DCAA  internal  quality  assurance  directorate’s  review  results 
of  50  percent  of  assignments  not  demonstrating  professional  judgment.  Additional 
information  on  the  DCAA  internal  quality  assurance  review  results  is  included  in  the 
‘Quality’  section  of  this  report. 

Recommendations,  Management  Comments,  and  Our 
Response 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

1.  Direct  each  audit  office  to  take  the  headquarters-determined  corrective 
action(s)  for  assignments  listed  in  Appendix  B  as  not  demonstrating 
professional  judgment.  Corrective  actions  might  include: 

a.  Rescinding  the  reports  and  notifying  those  who  received  the  reports  not 
to  rely  on  them  or  performing  additional  work  and  supplementing  the 
original  report,  whichever  action  is  most  appropriate  depending  on  how 
contracting  officers  are  using  or  relying  on  the  report  or  information  in 
the  report. 

DCAA  Comments 

DCAA  agreed  in  principle  stating  that  after  obtaining  additional  infonnation  from  DOD 
IG  on  the  noncompliances  with  GAGAS,  DCAA  would  assess  the  circumstances  for  the 
reports  not  demonstrating  professional  judgment  and  determine  the  appropriate  actions  in 
each  circumstance  by  June  30,  2013. 
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b.  Inserting  into  the  engagement  or  audit  documentation  file  a 
memorandum  stating  that  the  engagement  or  audit  did  not  comply  with 
government  auditing  standards,  the  work  should  not  be  relied  on  for 
other  engagements  or  audits,  and  the  assignment  should  not  be  used  as  an 
example  to  perform  other  engagements  or  audits. 

DCAA  Comments 

DCAA  agreed  stating  that  DCAA  would  include  a  memorandum  in  the  audit  file  for 
those  assignments  not  demonstrating  professional  judgment  by  December  31,  2012. 

c.  Reviewing  the  deficiencies  identified  in  the  various  assignments  and 
taking  appropriate  corrective  actions  regarding  the  audit  staff  involved  to 
include  additional  training  when  warranted. 

DCAA  Comments 

DCAA  agreed  in  principle  stating  that  since  FY  2009,  DCAA  has  taken  actions  to 
improve  audit  quality  and  reduce  noncompliances.  For  instance,  all  audit  staff,  including 
those  involved  in  the  assignments  not  demonstrating  professional  judgment,  received 
extensive  training  to  promote  compliance  with  GAGAS.  DCAA  also  stated  that  it  will 
continue  to  provide  additional  training  with  emphasis  on  improving  audit  quality.  DCAA 
considers  actions  already  taken  related  to  this  recommendation  to  be  complete. 

Our  Response 

DCAA  comments  were  responsive.  No  additional  comments  are  needed. 

2.  Re-emphasize  the  importance  of  compliance  with  government  auditing 
standards  and  applicable  Defense  Contract  Audit  Agency  policies  and 
procedures  through  issuance  of  alerts  or  other  appropriate  memorandums 
detailing  the  various  deficiencies  identified,  causes,  and  corrective  actions  to 
be  taken  by  all  audit  offices. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  since  FY  2009,  DCAA  took,  and  will 
continue  to  take,  significant  steps  to  improve  audit  quality  including  issuing  a  significant 
number  of  guidance  memorandums  and  providing  extensive  training.  DCAA  listed 
various  completed  and  in-process  efforts,  which  included  various  training  initiatives, 
workshops  and  conferences,  and  guidance  memorandums  or  audit  alerts  on  recurring 
issues  found  during  quality  assurance  reviews,  sampling  policy,  contractor  notification 
letters,  performing  sufficient  testing,  and  denial  of  access  to  records.  DCAA  considers 
actions  taken  in  response  to  this  recommendation  to  be  complete. 
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Our  Response 

DCAA  comments  were  responsive.  No  additional  comments  are  required. 

Independence 

Independence  Questioned 

GAGAS  3.03  and  3.10  require  the  auditor  and  the  audit  organization  to  be  free  from 
personal,  external,  and  organizational  impairments  to  independence,  and  to  avoid  the 
appearance  of  such  impairments.  We  identified  issues  with  independence  in  fact  or 
appearance  on  an  external  level  in  4  of  the  50  assignments  reviewed.  We  also  identified 
an  impairment  on  one  assignment  caused  by  undue  influence  resulting  in  failure  to 
exercise  professional  judgment.  For  an  additional  four  assignments,  we  were  unable  to 
detennine  whether  a  personal  impairment  existed  because  DCAA  did  not  provide  the 
detailed  infonnation  identifying  the  specific  personal  impairments  submitted  by  six 
auditors  who  worked  on  the  four  assignments.  Also,  in  one  assignment,  a  DCAA  audit 
office’s  verbal  agreement  with  a  contractor  could  result  in  restricted  access  to  a  document 
needed  for  another  DCAA  engagement. 

External  Impairments  Identified 

External  impairments  in  fact  or  appearance  existed  in  four  of  the  assignments  reviewed. 
GAGAS  3.10  requires  audit  organizations  to  be  free  from  external  impairments  to 
independence.  Factors  external  to  the  audit  organization  may  restrict  the  work  or 
interfere  with  the  auditors’  ability  to  form  independent  and  objective  opinions,  findings, 
and  conclusions. 

•  For  Assignment  Number  1 72 1-2009B 14980001,  the  supervisory  auditor  allowed 
the  contractor  to  improperly  influence  the  examination  engagement.  This 
engagement  involved  the  review  of  a  contractor’s  indirect  and  other  direct  cost 
internal  control  system,  which  processed  $708  million  in  FY  2007.  The 
supervisor  told  the  senior  auditor  and  technical  specialist  to  supersede  working 
papers  documenting  unallowable  travel  cost  identified  during  a  review  of  the 
travel  expense  reports  because  the  contractor  complained.  The  contractor 
objected  to  DCAA  citing  a  deficiency  because  the  travel  costs  had  not  yet  gone 
through  the  contractor’s  review  process  for  unallowable  costs  prior  to  certification 
of  its  incurred  cost  submission.  DCAA  should  have  still  cited  the  contractor  for 
an  internal  control  deficiency  because  controls  should  exist  in  the  travel  system  to 
screen  out  the  majority  of  unallowable  costs.  The  contractor  should  not  rely  on  its 
screening  process  prior  to  certifying  its  incurred  cost  submission  as  the  primary 
internal  control  against  claiming  unallowable  costs.  Failure  to  address  the 
deficiency  resulted  in  the  contractor  potentially  billing  unallowable  costs  on 
progress  payments  or  using  unallowable  costs  as  a  basis  for  proposals. 
Documentation  of  the  supervisory  auditor’s  decision  to  supersede  the  working 
papers  did  not  include  infonnation  regarding  the  contractor’s  objection. 
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Decisions  of  this  importance  based,  in  whole  or  part,  on  contractor  verbal  or 
written  objections  or  additional  information  provided  must  be  properly 
documented  in  the  working  papers. 

•  In  a  pre-award  accounting  system  examination  engagement  of  a  small  contractor 
with  $510,000  in  sales,  Assignment  Number  6431-2009B17740013,  the 
contractor  attempted  to  control  what  the  auditor  reviewed  by  providing  inaccurate 
or  incomplete  infonnation  and,  therefore,  restricted  the  work.  The  contractor 
stated  that  DCAA  had  performed  an  accounting  system  review  in  2006. 

However,  DCAA  was  unable  to  locate  that  assignment  or  any  evidence  that  the 
assignment  was  requested,  scheduled,  or  performed.  When  requested  to  provide 
information  on  its  Government  contracts,  the  contractor  never  listed  its 
subcontracts  on  the  U.S.  Navy  and  Department  of  Homeland  Security  contracts. 
The  auditor  never  independently  verified  the  contractor’s  sales  nor  its  contracts  or 
subcontracts  even  though  this  infonnation  would  be  used  to  select  vouchers  for 
review  in  the  engagement.  In  accepting  the  contractor’s  sales  and  contract 
information  without  independent  verification,  the  auditor  did  not  consider  that  the 
contractor  previously  provided  the  auditor  inaccurate  infonnation  by  erroneously 
telling  the  auditor  that  DCAA  had  already  performed  an  accounting  system 
review.  Using  incomplete  information,  the  auditor  selected  a  less  representative 
project,  a  grant,  to  trace  costs  through  the  contractor’s  accounting  system.  The 
auditor  allowed  the  contractor  to  improperly  influence  the  engagement  scope 
resulting  in  an  impainnent  to  independence.  GAGAS  3.10b  describes  an  external 
impairment  as  including  situations  where  external  interference  with  the  selection 
or  application  of  audit  procedures  or  in  the  selection  of  transactions  to  be 
examined  occurs. 

•  During  a  control  environment  internal  control  system  examination  engagement11 
of  a  contractor  with  FY  2009  sales  of  $674.4  million,  Assignment  Number  3311- 
2008C1 1070001,  the  contractor  redacted  information  on  80  out  of  85  contractor 
internal  hotline  cases,  rendering  the  information  useless  to  the  auditor.  The 
auditor  required  the  redacted  infonnation  in  the  internal  hotline  case  reports  to 
perform  procedures  key  to  the  engagement  objectives.  GAGAS  3.  lOd  describes 
an  external  impairment  as  situations  where  an  externally  imposed  restriction  on 
access  to  records  occurs.  Without  access  to  all  the  information  regarding  the 
internal  hotline  cases,  the  auditor  is  unable  to  evaluate  the  thoroughness  of  the 


1 1  The  control  environment  sets  the  tone  of  an  organization  and  influences  the  way  a  contractor  structures 
its  business  activities,  sets  its  objectives,  and  assesses  its  risks.  A  review  of  the  control  environment 
evaluates  key  components  such  as  integrity  and  ethical  values,  organization  structure,  assignment  of 
authority  and  responsibility,  human  resources  policies  and  procedures,  management  philosophy  and 
operating  style,  and  board  of  directors  or  audit  committee  participation.  Integrity  and  ethical  values 
includes  a  contractor’s  business  ethics  and  its  compliance  or  self-governance  program.  Contractor  internal 
hotline  reviews  or  inquiries  are  part  of  its  compliance  program. 
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contractor’s  internal  reviews  and  any  corrective  actions  taken.  This  step  is  key  to 

detennining  whether  the  contractor’s  ethics  program  is  operating  effectively  and 

12 

in  compliance  with  Government  acquisition  regulations. 

•  During  the  examination  engagement  of  $  1 .2  million  charged  to  a  Mentor  Protege 
contract,  Assignment  Number  1 66 1-2009H 17900002,  the  auditor  sent  the  draft 
report  to  the  requester  to  provide  comments  on:  (i)  the  DCAA  interpretation  of  the 
Mentor  Protege  Program  guidance  used  to  identify  questioned  costs;  (ii)  areas  in 
the  report  requiring  additional  information;  and  (iii)  the  content  and  fonnat  of  the 
report.  DCAA  auditors  routinely  check  with  the  requester  or  other  contracting 
officials  to  obtain  information  on  contract  tenns  or  other  criteria  used  in  the 
engagement.  However,  the  auditor  must  be  careful  that  DCAA  makes  the  final 
decision  regarding  how  the  criteria  are  interpreted  and  applied  during  the 
engagement  and  in  the  report.  GAGAS  3.10g  describes  an  external  impairment  as 
situations  where  an  external  party  inappropriately  influences  the  auditor’s 
judgment  as  to  the  appropriate  content  of  the  report.  When  the  DCAA  audit  staff 
asked  the  requester  to  comment  on  the  DCAA  interpretation  of  the  Program 
guidance  as  criteria  for  identifying  questioned  costs,  the  audit  staff  provided  the 
requester  the  opportunity  to  inappropriately  influence  the  report  findings  and 
content.  This  created  the  appearance  of  an  external  impairment. 

External  Impairment  Possible  Due  to  Audit  Office  Decision 

During  a  budget  and  planning  system  examination  engagement,  Assignment  Number 
4301-2009H1 1020002,  the  contractor  limited  access  to  its  long  range  strategic  plans  by 
granting  only  one  DCAA  auditor  access  to  the  document.  The  DCAA  audit  office 
conducting  the  review  believed  that  agreeing  to  the  contractor’s  access  restrictions  did 
not  negatively  impact  its  review  or  cause  an  impairment  to  independence.  However,  the 
contractor  representative  stated  during  discussions  that  the  contractor  wanted  to  restrict 
all  DCAA  access  to  the  document,  not  just  access  for  this  particular  assignment,  to  one 
auditor.  DCAA  guidance  instructs  the  audit  office  not  to  enter  into  written  agreements 
with  contractors  on  access  to  records  procedures.  Audit  offices  are  also  to  notify,  in 
writing,  a  contractor  when  its  documents  containing  policies  or  procedures  for  DCAA 
access  to  records  will  impede  the  audit  process.  DCAA  guidance  does  not  address 
situations  where  more  than  one  audit  office  may  require  access  to  the  same  infonnation. 
Verbal  access  to  records  agreements  should  be  coordinated  with  the  DCAA  audit  office 
cognizant  of  the  corporate  office  to  ensure  that  other  audit  offices’  access  is  not 
negatively  impacted.  By  not  formally  notifying  the  contractor  that  the  agreement  only 
applied  to  this  engagement,  the  audit  office  caused  a  potential  access  issue  and 
independence  impairment  in  general. 


12  This  assignment  is  also  discussed  in  the  Systemic  Issue  with  Insufficient  Evidence  in  Internal  Control 
System  Reviews  section  of  this  report  which  provides  additional  information  regarding  the  Government 
acquisition  regulation  requirements  for  a  contractor  ethics  program. 
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Missing  Recusal  Letters 

For  6  of  the  23  DCAA  auditors  who  checked  a  box  on  the  annual  independence 
statements  indicating  that  an  exception  to  personal  independence  existed,  DCAA  did  not 
provide  the  auditors’  written  explanations  identifying  the  specific  details  on  the 
impairment  or  situations  where  a  personal  impairment  existed.  ~  We  were,  therefore, 
unable  to  detennine  whether  a  personal  impairment  existed  on  four  assignments 
reviewed.  Four  of  the  six  missing  exception  or  recusal  documents  explained  exceptions 
noted  on  a  then-current  FY  2010  independence  statement.  DCAA  policy  requires  the 
audit  offices  to  maintain  current  independence  statements  in  the  personnel  files  kept  by 
the  first  level  supervisor.  Therefore,  these  four  missing  written  explanations  should  have 
been  available  and  we  could  not  verify  whether  the  supervisor  ever  received  details 
regarding  the  exceptions  from  the  auditors  or  considered  the  exceptions  as  required. 
Additional  infonnation  on  deficiencies  in  the  DCAA  quality  control  procedure  relating  to 
independence  is  discussed  in  the  Quality  section  of  this  report. 

Impairment  Associated  with  Undue  Influence  from  Financial 
Liaison  Advisor  Nonaudit  Service 

In  one  assignment,  we  identified  an  impairment  to  independence  created  by  another 
DCAA  component  that  provided  nonaudit  services.  GAGAS  3.03  states  that  an  auditor 
and  the  audit  organization  must  maintain  independence  so  that  their  opinions,  findings, 
conclusions,  judgments,  and  recommendations  will  be  impartial  and  viewed  as  impartial 
by  objective  third  parties  with  knowledge  of  the  relevant  infonnation.  Auditors  should 
avoid  situations  that  could  lead  objective,  knowledgeable  third  parties  to  conclude  that 
auditors  are  not  able  to  maintain  independence  and  impartial  judgment  on  all  issues 
associated  with  conducting  the  audit  and  reporting  on  the  work. 

During  the  planning  of  Assignment  Number  621 1-2009C13500003,  which  was  set  up  as 
a  comprehensive  labor  examination  engagement  involving  an  offsite  contractor  location, 
the  DCAA  headquarters  financial  liaison  advisor14  unduly  influenced  the  engagement 
scope.  The  audit  staff  assigned  to  perform  the  engagement  is  responsible  for  detennining 
the  appropriate  engagement  scope,  after  considering  the  engagement’s  objective  and  risk 
factors.  Acceptance  of  the  DCAA  headquarters  financial  liaison  advisor’s  opinion  by  the 
acting  supervisor  resulted  in  the  audit  staff  not  properly  designing  procedures  to  detect  an 
identified  fraud  indicator  -  employees  working  less  than  8-hours  a  day.  The  acting 
supervisor  initially  determined  that  a  comprehensive  labor  audit,  instead  of  a  floor  check, 


13  Organizations  may  refer  to  the  written  explanations  regarding  an  impairment  to  independence  as 
exception  or  recusal  letters. 

14  The  DCAA  financial  liaison  advisor  provides  advisory  audit  services  to  DOD  procurement  and  contract 
administration  offices  by  providing  onsite  accounting  and  financial  advice  to  contracting  officers, 
negotiators,  and  buyers.  Some  financial  liaison  advisor  duties  and  responsibilities  include:  facilitating 
effective  communication  and  coordination  between  procurement  officers  and  auditors  and  providing  advice 
to  the  procurement  office  in  connection  with  contractor’s  cost  representations  and  related  matters,  in 
consultation  with  the  cognizant  DCAA  audit  office.  DCAA  financial  liaison  advisors  report  to  and  are 
supervised  by  a  headquarters  DCAA  component.  DCAA  considers  financial  liaison  advisory  services  to  be 
a  nonaudit  service. 
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was  needed  to  adequately  address  the  requester’s  concern  that  contractor  employees  were 
not  working  full  8-hour  days.  The  DCAA  headquarters  financial  liaison  advisor 
overstepped  his  position’s  assigned  responsibilities  when  he  disagreed  with  the  acting 
supervisor’s  scope  assessment  in  an  e-mail  pointing  out  how  the  objectives  of  a  floor 
check  would  address  the  requester’s  needs.  A  main  function  of  the  DCAA  headquarters 
financial  liaison  advisor  is  to  facilitate  effective  communication  and  coordination 
between  a  requester  and  the  audit  staff  assigned  to  perform  the  engagement.  The  DCAA 
headquarters  financial  liaison  auditor  did  not  properly  perform  this  function  when  he  did 
not  explain  to  the  requester  the  acting  supervisor’s  concerns  and  need  to  expand  the 
engagement  scope.  DCAA  emphasizes  to  the  audit  offices  the  importance  of  meeting  the 
requester’s  needs  and  audit  offices  place  great  importance  on  a  financial  liaison  advisor’s 
opinions  concerning  the  appropriate  engagement  scope  needed  to  satisfy  the  request.  The 
DCAA  headquarters  emphasis  on  meeting  the  requester’s  needs  combined  with  the  fact 
that  financial  liaison  advisors  are  part  of  a  headquarters  directorate,  influenced  the  acting 
supervisor’s  decision  on  the  appropriate  scope  even  though  the  financial  liaison  advisor 
was  not  in  the  supervisor’s  management  chain  of  command.  In  the  end,  the  DCAA 
headquarters  financial  liaison  advisor  caused  an  impairment  to  independence  by 
improperly  influencing  the  acting  supervisor  causing  her  to  compromise  her  professional 
judgment  in  planning  and  conducting  the  engagement 

Revised  Finding  and  Deleted  and  Renumbered 
Recommendations 

We  revised  the  draft  finding  related  to  an  impairment  associated  with  a  nonaudit  service, 
which  was  originally  identified  as  an  organizational  impairment.  Also,  as  a  result  of 
management  comments,  we  deleted  draft  Recommendation  4  and  renumbered  the 
remaining  recommendations  accordingly.  The  Director,  DCAA,  stated  that  the  existing 
guidance  on  denial  of  access  to  records  was  sufficient  and  he  saw  no  benefit  to  revising 
guidance  to  address  one  particular  instance.  As  part  of  our  continuous  monitoring 
responsibilities,  we  will  monitor  access  to  records  issues  to  ascertain  whether  DCAA  has 
any  systemic  issues  related  thereto. 

Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

3.  Emphasize  to  the  audit  staff  the  importance  of  reporting  and  elevating  all 
access  to  records  issues  following  the  established  DCAA  process  and 
procedures. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  DCAA  included  a  presentation  on  access 
to  records  issues  in  the  Training  Initiative  on  Performing  Quality  Audits  given  between 
December  2010  and  April  2011  and  also  revised  the  annual  independence  on-line  CMTL 
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[Computer  Managed  Training  Library]  Course  No.  9022  to  emphasize  the  importance  of 
following  procedures  for  access  to  records  issues  in  September  2010.  In  addition,  DCAA 
stated  that  DCAA  issued  guidance  on  access  to  records  issues  dealing  with  attorney-client 
privilege  or  attorney-work-product  doctrine  assertions.  DCAA  considers  actions  taken  to 
address  this  recommendation  as  complete. 

Our  Response 

DCAA  comments  were  responsive.  On  September  20,  2012,  DCAA  provided  us  with 
CMTL  Course  No.  9022,  Independence  Training,  which  covers  access  to  records  issues. 
No  additional  comments  are  required. 

Competence 

Lack  of  Professional  Judgment  Evidenced  by  Significant 
GAGAS  Noncompliances 

The  abundance  of  noncompliances  with  standards  identified  in  the  37  assignments 
evidences  the  need  for  improvements  in  the  area  of  competence  at  DCAA.  GAGAS  3.33 
recognizes  that  competency  and  professional  judgment  are  interrelated  because 
judgments  made  are  dependent  on  the  auditors’  competence.  GAGAS  3.40  requires  that 
the  staff  assigned  to  perform  the  audit  or  attestation  engagement  must  collectively 
possess  adequate  professional  competence  for  the  tasks  required.  GAGAS  3.42  further 
emphasizes  that  competence  enables  an  auditor  to  make  sound  professional  judgments. 
Finally,  GAGAS  3.45  requires  auditors  who  perform  attestation  engagements  to  be 
knowledgeable  about  the  applicable  AICPA  attestation  standards  and  to  be  competent  in 
applying  them.  The  abundance  of  noncompliances  with  standards  could  have  resulted 
from  the  need  for  improvements  in  education,  training,  experience,  supervision, 
guidance,  or  skills. 

In  September  2008  and  October  2009,  Congress  held  hearings  on  the  results  of  GAO  and 
IG  reviews  of  two  Western  region  audit  offices.  Both  GAO  and  the  IG  provided  written 
products  to  DCAA  on  these  issues  before  the  hearings.  In  September  2008,  DCAA 
revised  its  perfonnance  metrics  eliminating  metrics  associated  with  set  budgeted  hours 
and  the  production  culture  previously  emphasized  by  DCAA  management.  In 
December  2008,  DCAA  eliminated  any  language  suggesting  that  the  audit  office  consider 
programmed  hours  when  establishing  budgeted  hours  for  an  assignment. 

Also,  in  September  2009,  GAO  emphasized  the  root  cause  of  the  DCAA  audit  failures 
was  a  production-oriented  environment  where  the  policies,  procedures,  and  training 
focused  on  audit  quantity  instead  of  audit  quality.  DCAA  perfonned  much  of  the  field 
work  on  the  assignments  we  reviewed  prior  to  September  2009  and  the  reports  were 
issued  from  October  2009  through  March  2010.  DCAA  stated  that  in  FY  2010  DCAA 
was  making  substantial  efforts  to  shift  their  policies,  procedures,  training,  and  culture 
from  a  focus  on  production  to  a  focus  on  audit  quality.  Therefore,  the  reviewed 
assignments  could  still  evidence  the  residual  effects  of  the  production-oriented 
environment.  Our  report  includes  recommendations  for  improvements  needed  in  audit 
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quality,  collective  staff  competence  and  organizational  culture.  These  recommendations 
are  in  addition  to  or  build  on  the  corrective  actions  already  taken  by  DCAA  to  improve 
the  quality  of  its  work  and  its  work  environment. 

Continuing  Professional  Education  Requirements  Met  But  Not 
Sufficient  to  Ensure  Quality  Work 

Compliance  with  the  quantitative  GAGAS  requirements  for  continuing  professional 
education  did  not  result  in  DCAA  auditors  performing  quality  work  in  compliance  with 
GAGAS.  DCAA  auditors  consistently  did  not  apply  key  auditing  concepts  required  by 
professional  standards  as  explained  in  the  Professional  Judgment;  Planning;  Evidence; 
Documentation;  Fraud,  Illegal  Acts,  Violations  of  Provisions  of  Contracts  or  Abuse;  and 
Supervision  sections  of  this  report.  The  abundance  of  noncompliances  identified  by  our 
review  call  into  question  the  effectiveness  of  the  DCAA  training  curriculum,  including  its 
delivery  methods. 

GAGAS  3.46  requires  auditors  perfonning  work  under  GAGAS  to  obtain,  every  2  years, 
the  following  continuing  professional  education: 

•  at  least  24  hours  directly  related  to  government  auditing,  the  government 
environment,  or  the  specific  or  unique  environment  in  which  the  audit 
organization  operates; 

•  56  additional  hours  that  enhances  the  auditor’s  professional  proficiency  to 
perfonn  audits  or  attestation  engagements;  and 

•  at  least  20  hours  in  each  year  of  the  2-year  period. 

Our  review  of  DCAA  compliance  with  continuing  professional  education  requirements 
did  not  identify  deficiencies  in  meeting  the  GAGAS  requirements  for  a  minimum  number 
of  continuing  professional  education  hours  in  various  general  categories.  We  identified 
only  a  few  instances  where  auditors  did  not  take  training  specified  as  mandatory  by 
DCAA  management.  The  abundance  of  noncompliances  with  GAGAS  identified  in  our 
review,  however,  indicates  that  the  qualitative  aspects  of  the  DCAA  training  program 
need  revamping. 

As  mentioned  previously  in  this  report,  DCAA  has  taken  corrective  actions  regarding  the 
training  provided  to  its  audit  staff  to  improve  audit  quality.  However,  DCAA 
management  needs  to  accurately  assess  the  audit  staffs’  skill  needs  as  required  by 
GAGAS  3.41  and  to  critically  analyze  the  DCAA  process  for  providing  needed  training, 
supervision,  guidance,  experience,  and  appropriate  skills.  DCAA  should  perform  a 
thorough  analysis  of  its  course  curriculum,  taking  into  account  any  changes  already 
made,  to  identify  appropriate  areas  where  the  individual  and  collective  competency  of  its 
staff  needs  to  be  enhanced.  DCAA  should  also  consider  outside  sources  for  core  training 
in  various  areas  including,  but  not  limited  to,  government  auditing  standards,  internal 
controls  and  related  systems  reviews,  and  AICPA  attestation  standards.  Training  from 
outside  sources  should  enhance,  not  replace,  DCAA-provided  training.  Training  geared 
to  more  generalized  audit  environments  or  topics  would  complement  DCAA-specific 
training  by  providing  a  stronger  foundation  for  DCAA  auditors  to  understand  general 
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auditing  and  accounting  concepts.  In  addition,  DCAA  should  use  a  variety  of  delivery 
methods  to  increase  the  successful  transfer  of  knowledge  from  the  classroom  to  the  actual 
audit  environment.  Finally,  to  increase  the  effectiveness  of  the  various  training  methods, 
DCAA  should  consider  increasing  the  amount  of  on-the-job  training  provided  by 
experienced  auditor-coaches  from  both  outside  and  inside  the  organization. 

Inexperienced  Auditors  Inappropriately  Assigned  to  Complex 
Engagements 

In  3  of  the  50  assignments  reviewed,  auditors  with  limited  experience  or  training  were 
assigned  to  complex  engagements.  In  two  assignments,15  the  auditors  either  did  not 
possess  the  knowledge  and  skills  required  or  did  not  receive  appropriate  supervision 
reflective  of  their  limited  experience  to  adequately  perfonn  the  assignment.  In  the  other 
assignment,16  increased  supervisor  and  audit  manager  involvement  made  up  for  the  lack 
of  experience  and  training  of  the  audit  staff.  GAGAS  3.33  discusses  the  interrelationship 
between  professional  judgment  and  competence  because  auditors’  judgments  are 
dependent  upon  the  auditors’  competence.  GAGAS  3.36  further  links  the  determination 
of  whether  professional  judgment  was  demonstrated  in  an  engagement  to  the 
appropriateness  of  the  consideration  of  the  collective  experience,  training,  knowledge, 
skills,  abilities,  and  overall  understanding  required  by  the  audit  team  and  its  members  to 
properly  perform  the  engagement.  Without  the  appropriate  mix,  the  audit  team  will  not 
be  able  to  properly  assess  the  risks  that  the  subject  matter  under  audit  may  contain  a 
significant  inaccuracy  or  could  be  misinterpreted.  Therefore,  DCAA  used  inexperienced 
auditors  under  limited  supervision,  which  contributed  directly  to  the  audit  teams  not 
demonstrating  professional  judgment.  DCAA  use  of  inexperienced  auditors  and  the 
associated  lack  of  professional  judgment  also  led  to  the  noncompliances  identified  in  the 
assignment  with  key  standards  such  as  planning,  evidence,  documentation,  and 
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reporting.  In  addition,  two  of  the  three  assignments  were  forward  pricing  examination 
engagements.  One  engagement  was  for  a  $98.8  million  firm- fixed-price  proposal  and  the 
other  engagement  reviewed  $16.6  million  in  travel  and  other  direct  costs  for  a  $30.8 

million  cost-plus-fixed-fee  proposal.  GAO  identified  an  issue  with  auditor  trainees  being 

1 8 

inappropriately  assigned  to  complex  forward  pricing  audits. 


15  The  two  assignments  numbers  are  621 1-2009C13500003  and  9861-2009P21000019.  Both  were 
examination  engagements. 

16  Assignment  Number  9761-2009T2700040  was  an  examination  engagement. 

17  GAGAS  noncompliances  identified  for  several  standards  led  to  an  overall  assessment  of  the  assignments 
not  meeting  professional  judgment.  For  details  regarding  the  noncompliances,  see  the  sections  of  this 
report  that  discuss  each  standard.  Additionally,  the  schedule  in  Appendix  B  summarizes  the  overall 
noncompliances  by  individual  assignment. 

18  The  finding  is  described  in  Case  8  on  page  22  of  GAO  Report  No.  GAO-08-857,  “DCAA  AUDITS: 
Allegations  That  Certain  Audits  at  Three  Locations  Did  Not  Meet  Professional  Standards  Were 
Substantiated,”  July  22,  2008. 
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Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

4.  Improve  the  effectiveness  of  Defense  Contract  Audit  Agency  training  by: 

a.  Performing  a  comprehensive  review  and  analysis  of  the  Defense  Contract 
Audit  Agency  continuing  professional  education  training  program, 
including  course  curriculum,  content  and  delivery  methods,  to  identify 
appropriate  areas  for  enhancement  of  the  individual  and  collective 
competency  of  its  staff. 

DCAA  Comments 

DCAA  agreed  in  principle  stating  that  DCAA  integrated  its  training  on  GAGAS  and 
AICPA  standards  into  several  training  courses  and  reviewed  all  Defense  Contract  Audit 
Institute  courses  to  ensure  GAGAS  requirements  are  addressed  when  applicable.  The 
DCAA  Advisory  Council  on  Learning  and  Talent  Development’s  review  of  the  Defense 
Contract  Audit  Institute  curriculum,  delivery  methods,  and  locations  was  to  be  finished 
by  September  30,  2012.  DCAA  plans  to  determine  which  recommendations  from  this 
review  should  be  implemented  and  take  the  appropriate  actions  at  a  date  to  be 
determined. 

Our  Response 

Management  comments  were  responsive.  No  additional  comments  are  required. 

b.  Using  outside  sources  for  certain  core  training  courses  to  supplement 
existing  Defense  Contract  Audit  Agency  training  courses  in  various  areas, 
including  but  not  limited  to,  government  auditing  standards,  internal 
controls  and  related  systems  reviews,  and  American  Institute  of  Certified 
Public  Accountants  attestation  standards. 

DCAA  Comments 

DCAA  agreed  in  principle  stating  that  the  Defense  Contract  Audit  Institute  already  uses 
external  sources  to  assist  in  developing  course  content  tailored  for  the  contract  audit 
environment  and  provided  several  examples.  DCAA  considers  the  action  to  address  this 
recommendation  complete.  On  September  19,  2012,  DCAA  stated  that  auditors  are 
encouraged  to  take  outside  training  and  subsequently  provided  a  list  of  external  courses 
taken  by  auditors  in  FY  2012.  DCAA  further  clarified  that  it  did  not  want  to  designate 
external  courses  as  “core”  or  required  courses. 

Our  Response 

DCAA  comments  were  responsive.  No  additional  comments  are  required. 
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c.  Performing  an  analysis  for  the  implementation  of  a  robust  on-the-job 
coaching  program  to  provide  auditors  and  supervisors  more  hands-on 
training  regarding  proper  application  and  interpretation  of  government 
auditing  standards  and  related  American  Institute  of  Certified  Public 
Accountants  attestation  standards. 

DCAA  Comments 

DCAA  agreed  in  principle.  On  August  1,  2012,  DCAA  announced  a  3  to  4  month  pilot 
coaching  program  of  100  nonbargaining  unit  employees.  The  objective  of  the  coaching 
program  is  to  assist  less  experienced  auditors  in  improving  their  technical  skills  and 
perfonnance.  DCAA  will  deploy  the  coaching  program  agency-wide  after  incorporating 
feedback  from  the  pilot  test  and  after  completing  negotiations  with  the  Union.  DCAA 
considers  the  action  taken  to  address  this  recommendation  as  complete. 

Our  Response 

DCAA  comments  were  responsive.  No  additional  comments  are  required. 

Quality  Control  and  Assurance 

Aspects  of  DCAA  Quality  Control  System  Ineffective 

In  46  of  the  50  assignments  reviewed,  the  DCAA  quality  control  system  was  ineffective 
in  ensuring  that  its  attestation  engagement  and  performance  audit  assignments  complied 
with  applicable  professional  standards.  GAGAS  3.50a  requires  that  an  audit  organization 
perfonning  work  in  accordance  with  government  auditing  standards,  establish  a  quality 
control  system  designed  to  provide  the  audit  organization  with  reasonable  assurance  that 
the  organization  and  its  personnel  comply  with  professional  standards  and  applicable 
legal  and  regulatory  requirements.  GAGAS  3.35  provides  that  using  professional 
judgment  in  all  aspects  of  carrying  out  professional  responsibilities,  including 
maintaining  appropriate  quality  control  over  the  assignment  process,  is  essential  to 
perfonning  and  reporting  on  an  engagement.  The  need  for  improvement  in  the  DCAA 
quality  control  system  was  evidenced  by  the  deficiencies  identified  in  multiple  standards 
areas;  in  engagements  perfonned  in  all  regions  and  Field  Detachment;  and  in  all 
engagement  types  reviewed.  Numerous  deficiencies  are  further  explained  in  other 
sections  of  this  report. 

DCAA  Quality  Assurance  Program 

The  DCAA  headquarters  Quality  Assurance  Directorate  perfonns  the  GAGAS-required 
monitoring  function  as  part  of  the  overall  DCAA  quality  control  system  as  described  in 
DCAA  Instruction  No.  7640.20,  “DCAA  Audit  Quality  Control  and  Assurance  Program,” 
dated  March  1 1,  201 1.  In  FY  2010,  the  DCAA  Integrity  and  Quality  Assurance 
Directorate  reviewed  28  audit  offices  and  465  assignments.  GAGAS  3.50  requires  audit 
organizations  to  establish  policies  and  procedures  in  its  system  of  quality  control  to 
address:  (1)  audit  and  attestation  engagement  perfonnance,  documentation,  and  reporting; 
and  (2)  monitoring  of  quality.  Monitoring  is  an  ongoing,  periodic  assessment  of  audit 
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and  attestation  engagements  designed  to  provide  management  of  the  audit  organization 
with  reasonable  assurance  that  the  policies  and  procedures  related  to  the  system  of  quality 
control  are  suitably  designed  and  operating  effectively  in  practice.  Monitoring  is  most 
effective  when  performed  by  individuals  who  do  not  have  responsibility  for  the  specific 
activity  being  monitored.  The  DCAA  internal  quality  assurance  program  is  to  cover 
GAGAS-covered  audit  work  from  approximately  one-third  of  the  DCAA  audit  offices  in 
each  year  of  a  given  3-year  period.  The  annual  review  plan  is  to  ensure  that: 

•  the  number  of  audit  offices  and  assignments  reviewed  will  provide  sufficient  data 
to  establish  DCAA’s  overall  level  of  compliance  with  GAGAS  and  DCAA 
policy; 

•  each  audit  office  is  eligible  to  be  selected  for  a  DCAA  headquarters  internal 
quality  assurance  review; 

•  the  majority  of  the  audit  offices  will  actually  undergo  such  a  review  within  each 
3 -year  planning  cycle; 

•  all  types  of  DCAA  assignments  with  reports  issued  and  perfonned  in  accordance 
with  GAGAS  will  be  included  in  the  universe  of  assignments  to  be  reviewed;  and 

•  significant  coverage  of  the  different  assignment  types  should  be  provided,  while 
still  providing  sufficient  data  on  any  one  type  to  enable  meaningful  conclusions  to 
be  drawn  with  regard  to  DCAA’s  level  of  compliance  with  a  particular  GAGAS 
requirement. 

DCAA  Instruction  No.  7640.20  provides  additional  guidance  and  information  on  how  the 
DCAA  Integrity  and  Quality  Assurance  Directorate  should  perform  its  internal  quality 
assurance  reviews.  The  DCAA  Integrity  and  Quality  Assurance  Directorate  performs:  (i) 
formal  internal  quality  assurance  reviews  based  on  guidelines  established  by  the  CIGIE; 
and  (ii)  quality  assurance-related  review  projects  perfonned  on  a  DCAA -wide  basis. 
When  perfonning  these  reviews,  the  DCAA  Quality  Assurance  Directorate  assesses 
compliance  with  applicable  auditing  standards  and  DCAA  audit  policies  and  procedures. 

DCAA  Quality  Assurance  Reviews  Identified  Significant 
Deficiencies  in  DCAA  Attestation  Engagements 

During  its  internal  quality  assurance  reviews  of  FY  2010  assignments,  the  DCAA 
Integrity  and  Quality  Assurance  Directorate  determined  that  50  percent  of  all  assignments 
that  it  reviewed  did  not  demonstrate  professional  judgment.  The  FY  2010  DCAA 
internal  quality  assurance  reviews  found  that  50  percent  of  the  reviewed  assignments 
demonstrated  a  lack  of  professional  judgment.  The  DCAA  review  results  are  lower  than 
our  finding  of  a  74  percent  noncompliance  rate  for  assignments  perfonned  during  the 
same  time  period. 19  A  summary  of  the  FY  2010  DCAA  Integrity  and  Quality  Assurance 
Directorate  review  results  are  detailed  in  Table  3. 


19  One  difference  between  our  scope  of  review  and  the  DCAA  internal  quality  assurance  program  reviews 
was  that  our  review  included  assignments  performed  by  DCAA  Field  Detachment  offices  in  addition  to  all 
five  regions.  The  DCAA  internal  quality  assurance  reviews  excluded  Field  Detachment  assignments 
during  the  first  half  of  FY  2010,  but  covered  assignments  from  all  five  regions  and  Field  Detachment  for 
the  second  half  of  FY  2010. 
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Table  3.  FY  2010  DCAA  Quality  Assurance  Review  Results  on  Compliance  with 
_ Professional  Judgment  Standard  by  Time  Period _ _ 


DCAA  Quality  Assurance 

Reviews 

Number  of 

Audit 

Offices 

Reviewed 

Number  of 
Assignments 
Reviewed 

Number  of 
Assignments 
Reviewed 
Not  Meeting 
Professional 
Judgment 
Standard 

Assignments 
Reviewed  Not 
Meeting 
Professional 
Judgment 
Standard 

1st  Half  FY  2010  (October  through  March) 

13 

219 

92 

42  percent 

2nd  Half  FY  2010  (  April  through 

September) 

15 

246 

142 

58  percent 

FY  2010  Results 

28 

465 

234 

50  percent 

For  the  second  half  of  FY  2010,  the  DCAA  Integrity  and  Quality  Assurance  Directorate 
reviews  found  an  increase  in  the  number  of  assignments  not  meeting  the  professional 
judgment  standard  from  42  percent  to  58  percent.  Based  on  the  DCAA  quality  assurance 
review  results,  the  Director,  DCAA,  detennined  that  the  audit  offices  needed  additional 
training  on  compliance  with  GAGAS.  From  November  2010  to  April  2011,  the  DCAA 
Integrity  and  Quality  Assurance  Directorate  provided  additional  GAGAS  training  to  all 
audit  offices,  regional  offices  and  Field  Detachment  headquarters  staff.  We  will  assess 
the  effectiveness  of  this  training  during  future  reviews. 

Inadequate  Quality  Control  Procedures  for  Documentation  of 
Personal  Impairments 

We  identified  implementation  deficiencies  relating  to  documentation  of  personal 
impairments  in  46  percent,  23  of  the  50  reviewed  assignments.  DCAA  quality  control 
procedures  for  documenting  and  detennining  potential  or  actual  impairments  to  personal 
independence  were  either  not  properly  designed  or  did  not  operate  effectively  to  ensure 
compliance  with  GAGAS  requirements.  As  a  result,  we  were  unable  to  detennine 
conclusively  whether  auditors  who  worked  on  the  reviewed  assignments  had  any 
personal  impairments  associated  with  the  assignments.  GAGAS  3.52  requires  an  audit 
organization  to  document  compliance  with  its  quality  control  policies  and  procedures  and 
to  maintain  the  documentation  for  a  period  of  time  sufficient  to  enable  others  to  evaluate 
the  extent  of  the  audit  organization’s  compliance  with  its  quality  control  policies  and 
procedures.  GAGAS  3.53b  lists  policies  and  procedures  designed  to  provide  reasonable 
assurance  that  the  audit  organization  and  its  personnel  maintain  independence  as  needed 
for  its  quality  control  system. 

DCAA  policy  for  documentation  of  personal  independence  required:  (1)  audit  staff  to 
complete  the  Statement  of  Independence  (DCAA  Form  7640-2)  each  year  after 
completing  annual  independence  training;  (2)  Regional  Directors  to  certify  annually  that 
mandatory  training  and  signing  of  Statements  on  Independence  had  occurred;  (3)  audit 
offices  to  maintain  the  most  current  Statements  on  Independence  in  the  audit  staff 
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personnel  records  maintained  by  the  first  level  supervisor;  (4)  all  newly  hired  auditors  to 
complete  the  training  and  independence  statement  prior  to  working  on  an  assignment;  and 
(5)  an  auditor  to  notify  the  appropriate  DCAA  management  official,  in  writing,  of  any 
exception.  The  policy  does  not  provide  a  separate  form  or  specific  place  on  the 
independence  statement  fonn  for  the  audit  staff  to  document,  describe,  or  explain  the 
exceptions  when  the  exception  box  is  checked.  DCAA  should  revise  its  guidance  or 
Statement  of  Independence  form  to  do  so. 

We  identified  deficiencies  in  the  design  and  implementation  of  the  quality  control 
procedure  for  documenting  personal  impairments  to  independence,  impacting  23  of  the 
50  reviewed  assignments.  Of  the  309  audit  staff  members  that  worked  on  the  reviewed 
assignments,  we  did  not  receive: 

•  any  independence  statements  for  19  audit  staff  members; 

•  the  current  FY  independence  statements  for  6  audit  staff  members;  and 

•  properly  filled  in  independence  statements  for  19  audit  staff  members.  This 
included  statements  where  the  independence  status  boxes  were  not  marked;  the 
supervisor  did  not  sign  the  statement;  and  recusal  or  exception  letters  or  some 
type  of  written  description  of  the  exception  were  not  provided  as  previously  noted 
above  in  the  Independence  section  of  this  report. 

Additionally,  10  of  the  309  audit  staff  members  were  newly  hired  auditors.'  Fifty 
percent  of  the  newly  hired  auditors,  5  out  of  10,  did  not  fill  in  the  required  independence 
statements  prior  to  starting  the  reviewed  assignment.  In  one  case,  a  newly  hired  auditor 
did  not  complete  the  independence  statement  until  2  months  after  report  issuance,  and 
7  months  after  being  hired  and  completing  the  independence  training.  DCAA  should 
perfonn  an  assessment  of  its  on  boarding  process  and  associated  management  oversight 
and  controls  over  completion  of  the  Statements  of  Independence  to  determine  how  to 
better  ensure  that  newly  hired  auditors  submit  a  completed  Statement  of  Independence  as 
soon  as  possible  after  starting  to  work  with  DCAA  as  required  by  its  quality  control 
policies  and  procedures  in  its  Contract  Audit  Manual  (CAM). 

Changes  to  Procedures  Should  Improve  Compliance  with 
GAGAS 

In  March  2010,  the  DCAA  Integrity  and  Quality  Assurance  Directorate  briefed  us  that 
they  communicated  concerns  to  DCAA  management  that  audit  offices  were  only  keeping 
the  current  independence  statement.  Therefore,  all  of  the  needed  independence 
statements  were  not  available  when  the  reviewed  assignments  carried  over  from  prior 
fiscal  years."  On  August  2,  201 1,  DCAA  issued  Memorandum  for  Regional  Directors 
(MRD)  1 1 -PAS-0 13,  “FY  2011  Annual  Training  on  the  Generally  Accepted  Government 
Auditing  Standards  (GAGAS)  Independence  Standards,”  modifying  the  previous  DCAA 


20  Newly  hired  auditors  are  auditor-trainees  who  have  worked  for  DCAA  for  1  year  or  less. 

21  Twenty-five  of  the  50  assignments  we  reviewed  required  independence  statements  from  more  than 
1  year. 
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requirements  pending  the  overall  reassessment  of  independence  documentation 
procedures.  Audit  offices  are  now  to  maintain  not  only  the  most  current  independence 
statements,  but  also  annual  independence  statements  from  prior  years  that  were  filed  in 
the  audit  staff  personnel  records  maintained  by  the  first-level  supervisor.  DCAA  revised 
the  process  to  ensure  that  the  required  independence  statements  are  available  for  internal 
and  external  reviews.  However,  this  guidance  still  does  not  address  documenting  written 
explanations  provided  by  an  auditor  to  the  first-level  supervisor  for  any  identified 
exceptions.  Therefore,  additional  improvements  are  needed  to  ensure  that  the  related 
exception  letters  or  written  explanations  are  also  maintained  and  available  for  reviewers. 
As  noted  above,  DCAA  is  currently  evaluating  their  overall  policies  for  documenting 
independence.  We  will  assess  the  effectiveness  of  the  procedural  change  and  any  other 
policy  changes  in  future  reviews. 

Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

5.  Revise  guidance  on  maintaining  Statements  of  Independence  to  specify  that 
all  written  explanations  describing  exceptions  to  personal  independence 
provided  to  the  first-level  supervisor  must  also  be  maintained  for  the  same 
period  of  time  as  the  Statements. 

DCAA  Comments 

DCAA  agreed  in  principle  stating  that  DCAA  will  revise  policy  so  Statements  of 
Independence  are  only  applicable  to  a  particular  assignment  and  the  associated  contractor 
and  will  not  include  independence  issues  related  to  other  contractors.  DCAA  stated  it 
would  complete  this  action  by  June  30,  2013. 

Our  Response 

DCAA  comments  and  subsequent  actions  are  fully  responsive  to  the  intent  of  the 
recommendation.  On  November  16,  2012,  DCAA  included  a  reminder  in  its  FY  2013 
announcement  of  annual  training  on  GAGAS  Independence  Standards  to  retain  annual 
independence  statements  from  prior  years  and  to  attach  any  personal  recusal  letters  to  the 
independence  statements.  No  additional  comments  are  required. 


6.  Perform  an  assessment  of  the  new  hire  on-boarding  process  and  implement 
the  additional  steps  or  controls  needed  to  ensure  that  newly  hired  auditors 
complete  independence  training  and  submit  a  Statement  of  Independence 
within  the  first  week  of  work  at  the  audit  office  or  prior  to  working  on  any 
assignment,  whichever  event  occurs  first. 
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DCAA  Comments 

DCAA  agreed  in  principle  stating  it  would  implement  a  consistent  approach  on  the  new 
hire  on-boarding  process  that  will  include  training  on  GAGAS  Independence  Statements, 
and  require  supervisors  to  explain  auditor  independence  to  the  new  hire  to  ensure  they 
complete  a  Statement  of  Independence  prior  to  performing  any  audit  work.  DCAA  stated 
it  would  implement  this  process  by  December  3,  2012. 

Our  Response 

DCAA  comments  were  responsive.  No  additional  comments  are  required. 

DCAA  Regional  and  Field  Detachment  Offices’  Quality  Control 
Procedures  Need  Improvement 

The  DCAA  regional  and  Field  Detachment  quality  control  procedures  were  generally 
ineffective  in  ensuring  that  attestation  engagements  and  performance  audits  complied 
with  GAGAS  and  DCAA  policies  and  procedures.  The  quality  control  procedures 
including  regional  and  Field  Detachment  management  pre-issuance  reviews  varied 
among  regions  and  Field  Detachment.  The  regional  and  Field  Detachment  pre-issuance 
reviews  did  not  identify  significant  noncompliances  with  GAGAS  and  resulted  in  the 
regional  or  Field  Detachment  audit  managers  approving  reports  that  should  not  have  been 
issued.  In  addition,  the  regions  and  Field  Detachment  management  did  not  have  adequate 
procedures  in  place  to  ensure  that  audit  offices  complied  with  the  regional  and  Field 
Detachment  quality  control  procedures  for  which  the  audit  offices  were  assigned 
responsibility. 

Only  32  percent,  16  of  the  50  reviewed  assignments  included  a  regional  or  Field 
Detachment  pre-issuance  review  of  the  report.  Regional  and  Field  Detachment 
management  is  responsible  for  maintaining  quality  control  systems  to  provide  reasonable 
assurance  that  auditors  comply  with  professional  standards  and  applicable  legal  and 
regulatory  requirements.  To  perform  this  function,  regional  and  Field  Detachment 
directors  issued  instructions  establishing  regional  or  Field  Detachment  quality  control 
programs  that  assigned  regional  audit  managers  certain  responsibilities  which  vary 
among  the  different  regions  and  Field  Detachment.  Quality  control  procedures 
perfonned  by  regional  audit  managers  include  reviewing  high  risk  assignments  and 
reports  prior  to  their  issuance,  perfonning  post-issuance  reviews,  or  evaluating  corrective 
action  plans  submitted  in  response  to  DCAA  quality  assurance  reviews.  In  addition,  most 
of  the  regions  and  Field  Detachment  quality  control  procedures  require  pre-release 
reviews  by  regional  technical  specialists  of  specific  assignment  types  either  before  or 
concurrent  with  the  regional  audit  manager  reviews.  However,  the  requirements  for 
regional  or  Field  Detachment  management  pre-issuance  reviews  also  vary  considerably 
between  the  regions  and  Field  Detachment.  Often  whether  a  regional  review  is  required 
depends  on  the  significance  of  the  dollars  examined  or  the  dollar  amount  of  the  findings. 

Regional  management  reviews  when  perfonned  also  were  not  an  effective  quality  control 
procedure  to  ensure  that  the  engagements  complied  with  GAGAS.  Of  the  above  16 
assignments  in  which  regional  or  Field  Detachment  management  reviewed  and  approved 
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the  report  to  be  issued,  we  determined  that  12  lacked  professional  judgment  and  DCAA 
should  not  have  issued  those  reports.  For  instance, 

•  A  Central  region  regional  audit  manager  approved  the  report  issuance  for  an 
incurred  cost  examination  engagement  of  $102  million.  However,  the  regional 
audit  manager  did  not  identify  and  have  the  audit  office  remedy  several 
significant  deficiencies  during  the  required  pre-release  review  of  the  assignment 
and  draft  report.  In  particular,  the  regional  audit  manager’s  review  did  not  find 
that  the  auditor  performed  insufficient  testing  to  support  the  opinion  on  claimed 
costs  and  that  the  report  lacked  several  key  qualifications.  (Assignment  Number 
3 17 1-2006 J 10 100002) 

•  Both  the  regional  audit  manager  and  the  regional  technical  programs  division 
perfonned  required  pre-release  reviews  of  an  examination  of  the  indirect  and 
other  direct  cost  system  at  a  major  defense  contractor  with  $3.4  billion  in 
government  sales.  The  regional  audit  manager  commented  in  his  approval  e-mail 
that  “the  report  looks  real  good.”  However,  neither  regional  quality  control 
review  identified  critical  noncompliances  with  GAGAS.  For  instance,  the 
supervisory  auditor  allowed  the  contractor  to  improperly  influence  the  scope  of 
testing  perfonned  on  unallowable  costs;  evidence  was  insufficient  to  support  the 
report;  documentation  of  work  performed  to  support  the  reported  conclusions  was 
inadequate;  and  the  auditor  did  not  follow-up  to  obtain  a  formal  written  response 
from  the  contractor  on  the  reported  deficiencies.  (Assignment  Number  172 1  - 
2009B 14980001) 

Finally,  13  audit  offices  did  not  have  an  audit  office  instruction  documenting  quality 
control  policies  and  procedures  as  required  by  the  respective  regional  or  Field 
Detachment  quality  control  instruction.  Audit  office  noncompliance  with  regional  or 
Field  Detachment  quality  control  procedures  further  weakened  the  effectiveness  of  such 
procedures. 

DCAA  regional  and  Field  Detachment  management  should  reassess  their  quality  control 
programs  and  make  revisions  to  increase  the  programs’  effectiveness  at  promoting  and 
ensuring  audit  quality.  DCAA  should  consider  establishing  minimum  requirements  for 
regional  and  Field  Detachment  quality  control  procedures  to  increase  consistency  and  the 
overall  effectiveness  of  such  procedures. 

Limited  and  Ineffective  Audit  Office-Specific  Quality  Control 
Procedures 

DCAA  audit  offices  had  limited  and  ineffective  audit  office-specific  quality  control 
procedures.  Audit  offices  did  not  fully  implement  the  use  of  participatory  work  team 
member  reviews-  to  improve  compliance  with  GAGAS.  Some  audit  offices  also  did  not 


22  DCAA  uses  the  term  “peer  review”  to  denote  one  team  member’s  review  of  another  team  member’s 
assignment.  Our  report  uses  “participatory  work  team  member  review”  when  discussing  this  quality 
control  procedure  to  avoid  confusion  with  the  “external  peer  review”  required  by  GAGAS  3.55. 
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comply  with  the  GAGAS  requirement  to  maintain  documentation  on  compliance  with  its 
quality  control  policies  and  procedures.  Additionally,  some  audit  offices  did  not  comply 
with  their  own  or  regional  or  Field  Detachment  quality  control  procedure  requirements 
further  limiting  the  effectiveness  of  those  procedures. 

Only  24  of  the  50  assignments  reviewed  required  a  participatory  work  team  member 
review.  DCAA  guidance  provides  that  its  basic  system  of  quality  control  encompasses  its 
organizational  structure.  The  guidance  specifically  includes  participatory  work  teams  as 
part  of  the  organizational  structure  at  the  audit  office  level.  DCAA  headquarters 
encouraged  audit  offices  to  use  participatory  work  teams  to  enhance  the  overall  quality  of 
their  working  papers  and  reports  by  increasing  compliance  with  GAGAS.  A 
participatory  work  team’s  responsibilities  can  vary  and  include: 

•  establishing  a  participatory  work  team  member  review  process  for  the  working 
paper  files  and  reports  to  incorporate  the  number  and  type  of  assignments  subject 
to  the  team  member  review; 

•  detennining  the  objectives  and  scope  for  the  participatory  work  team  member 
review; 

•  detennining  how  the  auditor  performing  the  participatory  work  team  member 
review  is  to  document  the  review  and  its  results;  or 

•  discussing  general  recurring  type  enors  and  process  improvements  at  team 
meetings. 

Despite  participatory  work  team  member  reviews,  we  still  identified  a  significant  number 
of  deficiencies  and  noncompliances  with  GAGAS.  Our  review  detennined  that  12  of  the 
30  assignments  with  a  documented  participatory  work  team  member  review  did  not 
demonstrate  professional  judgment.  DCAA  needs  to  reconsider  the  usefulness  of  the 
participatory  work  team  member  review  process  as  a  quality  control  procedure. 

In  addition,  4  of  the  24  assignments  that  required  participatory  work  team  member 
reviews  did  not  contain  evidence  of  the  required  review  or  the  audit  office  did  not 
provide  us  acceptable  documentation  that  the  required  procedures  had  been  perfonned. 
GAGAS  3.52  provides  that  an  audit  organization  should  document  compliance  with  its 
quality  control  policies  and  procedures,  and  maintain  the  documentation  so  that  other 
reviewers  can  evaluate  the  extent  of  the  organization’s  compliance  with  its  quality  control 
policies  and  procedures.  Therefore,  to  comply  with  GAGAS,  all  audit  offices  need  to 
maintain  such  documentation. 

Finally,  audit  offices  did  not  comply  with  all  their  own  required  quality  control 
procedures  or  all  the  regional  or  Field  Detachment  management  required  procedures.  As 
mentioned  above,  not  all  audit  offices  had  a  required  office  quality  control  procedure.  Of 
the  50  assignments  reviewed,  16  were  perfonned  at  audit  offices  that  also  did  not  comply 
with  applicable  region  or  audit  office-required  supplemental  quality  control  procedures, 
forms,  or  checklists  for  assignments. 
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Independent  Reference  Review  Requirement  Implemented  to 
Improve  Quality 

DCAA  implemented  the  use  of  independent  reference  reviews  as  a  component  of  its 
commitment  to  providing  quality  reports  in  compliance  with  applicable  standards.  On 
July  25,  2011,  DCAA  issued  guidance  requiring  audit  offices  to  assign  General  Schedule 
[GS]  13  audit  staff  to  perfonn  independent  reference  reviews  for  certain  specified 
engagements  requiring  a  report  as  well  as  any  assignments  that  pertain  to  sensitive, 
controversial,  complex,  unusual,  or  significant  matters.  The  guidance  requires  that  all 
independent  reference  review  documentation  be  maintained  in  the  working  paper  file. 

We  will  review  the  implementation  and  its  effectiveness  in  future  reviews. 

Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

7.  Issue  guidance  directing  regions,  Field  Detachment,  and  audit  offices  to  fully 
comply  with  generally  accepted  government  auditing  standards 
paragraph  3.52  requirements  to  maintain  documentation  of  all  quality 
control  procedures  performed  by  the  regions,  Field  Detachment,  or  audit 
offices  such  as  participatory  team  member  reviews  or  regional  audit 
manager  pre-release  reviews,  for  a  sufficient  amount  of  time  so  that 
reviewers  can  evaluate  the  extent  of  their  compliance  with  the  relevant 
quality  control  procedure. 

DCAA  Comments 

DCAA  agreed  in  principle  stating  that  the  implementation  of  the  DCAA  independent 
reference  review  policy  and  actions  that  will  result  from  the  in-process  publication  reform 
initiative  would  address  this  recommendation.  DCAA  also  stated  that  its  publication 
system  reform  initiative  to  review  regional  and  Field  Detachment  quality  control 
publications  to  ensure  consistency  across  the  agency  and  eliminate  publications  that  are, 
or  should  be,  addressed  agency-wide  would  be  completed  by  March  31,  2013. 

Our  Response 

DCAA  comments  were  responsive.  No  additional  comments  are  required.  As  part  of  our 
followup  and  monitoring  responsibilities,  we  will  consider  whether  the  in-process 
publication  reform  initiative  fully  satisfies  the  intent  of  this  recommendation. 


8.  Review  existing  audit  office,  regional,  and  Field  Detachment  quality  control 
procedures  to  identify  best  practices  or  other  possible  quality  procedures  to 
be  implemented  that  would  be  effective  in  ensuring  audit  quality  and 
compliance  with  government  auditing  standards.  The  review  should 
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consider  establishing  minimum  standards  for  regional  and  Field  Detachment 
quality  control  procedures,  as  well  as  audit  office  quality  control  procedures, 
to  better  ensure  effective  implementation  of  the  DCAA  quality  control 
system. 

DCAA  Comments 

DCAA  agreed  in  principle  stating  that  DCAA  communicates  best  practices  through 
training,  staff  conference  presentations,  its  Quality  website,  and  in  quality  assurance 
review  reports.  DCAA  also  stated  it  would  complete  its  publication  system  refonn 
initiative,  as  discussed  in  response  to  Recommendation  7,  by  March  31,  2013. 

Our  Response 

Management  comments  were  responsive.  No  additional  comments  are  required. 

Examination  Engagements 

Planning 

Deficiencies  in  Planning 

Thirty-one  (3 1)  of  the  47  reviewed  examination  engagements-  did  not  comply  with 
GAGAS  requirements  for  planning.  Most  deficiencies  were  caused  by  poor  risk 
assessments,  incomplete  identification  of  relevant  criteria,  failure  to  follow  up  on  prior 
review  results,  inadequate  understanding  of  internal  controls,  and  lack  of  coordination 
with  other  auditors.  GAGAS  6.04a.  requires  the  auditor  to  adequately  plan  the  work. 
According  to  the  AICPA  standards  for  attestations  engagements,  planning  involves 
developing  an  overall  strategy  for  the  expected  conduct  and  scope  of  the  engagement. 

The  auditor  should  consider  the  nature,  extent,  and  timing  of  the  work  to  be  performed  to 
accomplish  the  objectives  of  the  engagement.  During  the  planning  process,  an  auditor 
should  consider  the  criteria  to  be  used;  preliminary  judgment  about  risk  and  materiality; 
the  nature  of  the  subject  matter  or  the  items  within  the  assertion  that  are  likely  to  require 
revision  or  adjustment;  conditions  that  may  require  extension  or  modification  of 
procedures;  and  the  nature  of  the  report  to  be  issued. 

Planning  Deficiencies  Identified  with  AICPA  Attestation  Standards 

Table  5  provides  examples  of  the  deficiencies  in  DCAA  engagement  planning  in  relation 
to  the  AICPA  Attestation  Standards  incorporated  into  GAGAS. 


23  An  examination  engagement  or  examination  provides  positive  assurance.  GAGAS  1.23a  states  that  an 
examination  “...[cjonsists  of  obtaining  sufficient,  appropriate  evidence  to  express  an  opinion  on  whether 
the  subject  matter  is  based  on  (or  in  conformity  with)  the  criteria  in  all  material  respects  or  the  assertion  is 
presented  (or  fairly  stated),  in  all  material  respects,  based  on  the  criteria.” 


26 


Table  5.  Examples  of  Planning  Deficiencies 


Area 

Planning  Deficiencies  Examples 

Identification  of 
Criteria  to  Be  Used 

AT24  101.45a 

In  eight  examination  engagements,  the  auditor  did  not  identify  the 
appropriate  criteria  to  be  used  in  perfonning  the  engagement.  This  is  a 
repeat  deficiency  identified  in  our  prior  review  of  the  FY  2006  DCAA 
quality  control  system.  DCAA  non-concurred  with  our  previously 
recommended  corrective  action  to  list  specific  criteria  on  the  planning 
documentation  because  they  felt  the  existing  DCAA  guidance  was 
sufficient  to  comply  with  GAGAS. 

•  In  an  examination  of  billed  mentor  protege  costs  of  $  1 .2  million,  the 
auditor  identified  numerous  sources  for  criteria  including  the 
Department  of  Navy  Mentor  Protege  Program  Procedures  Manual, 
but  failed  to  use  the  correct  version  of  the  manual.  The  auditor  used 
the  December  2008  instead  of  the  May  2005  version  in  effect  at  the 
contract  signing.  The  error  was  not  identified  until  the  contractor 
responded  to  the  findings.  The  auditor  verified  that  the  requirement 
used  to  support  the  finding  had  not  changed  from  the  2005  version, 
but  did  not  verify  whether  any  other  provisions  used  as  criteria  were 
different.  Additionally,  the  auditor  did  not  include  all  pertinent 
contract  tenns  in  the  contract  brief  to  use  as  criteria.  The  oversight 
resulted  in  the  auditor  identifying  an  erroneous  finding  regarding 
lease  purchase  of  equipment  that  was  allowed  by  the  contract. 
Incomplete  or  inaccurate  criteria  used  during  planning  and  not 
corrected  during  execution  results  in  the  auditor  spending  additional 
time  to  correct  the  preliminary  findings.  (Assignment  No.  1661- 
2009H 17900002) 

Preliminary 

Judgments  on  Risk 
and  Materiality 

AT  101.45b 

In  nine  examination  engagements,  the  auditor  did  not  adequately  address 
the  materiality  and  sensitivity  of  the  engagement. 

•  During  the  examination  of  a  large  contractor’s  billing  system,  the 
auditor  did  not  complete  the  required  Internal  Control  Audit  Planning 
Summary  working  paper.  The  auditor  should  use  this  information  to 
detennine  the  appropriate  risk  level  for  planning  the  engagement. 

The  audit  office  did  not  reconcile  or  address  a  significant  discrepancy 
regarding  the  amount  of  dollars  being  processed  through  the  billing 
system.  The  auditor  stated  in  the  risk  assessment  steps  that  the 
system  processed  approximately  $34  million,  but  another  working 
paper  showed  approximately  $4,396  billion  as  being  processed.  One 
of  the  key  factors  for  the  level  of  internal  control  testing  needed  is  the 
dollars  processed  through  the  system.  (Assignment  No.  2641- 
2009C1 1010001) 

Sufficient 

Knowledge  of 

Events,  Transaction, 

In  eight  examination  engagements,  the  auditor  did  not  document  all 
relevant  background  infonnation  needed  to  adequately  evaluate  the 
subject  matter  of  the  engagements. 

24  The  AICPA  uses  the  designation  of  “AT”  to  reference  the  various  attestation  standards. 
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Area 

Planning  Deficiencies  Examples 

and 

Practices/Background 

Information 

AT  101.44 

•  In  a  purchasing  system  examination  of  a  contractor  with  $  140  million 
in  sales,  the  auditor  stated  in  the  working  papers  that  they  would 
request  organizational  charts,  pertinent  records  layout,  database 
source  documents,  information  on  the  conversion  of  documents  to 
computer  media,  and  a  listing  of  files  affected  by  the  system. 

However,  the  auditor  never  received  the  documents  that  were  needed 
to  properly  plan  the  engagement.  (Assignment  No.  1261- 
2010A12030001) 

Significant  Changes 

AT  101.45d& 

101.47 

In  five  examination  engagements,  the  auditor  did  not  make  the 
appropriate  changes  to  the  planned  work  due  to  circumstances  that  arose 
in  the  engagement. 

•  In  a  disclosure  statement  adequacy  examination  at  a  contractor  with 
sales  of  $320  million  in  2008,  the  auditor  acknowledged  the 
contracting  officer’s  request  for  a  disclosure  statement  review  for 
adequacy  and  compliance;  however,  the  auditor  only  performed  an 
adequacy  review.  The  auditor  did  not  document  a  reason  for  the 
reduced  scope  of  work,  or  inform  the  contracting  officer  of  the 
adjustment  in  planned  work.  Although  the  audit  office  stated  a 
compliance  review  would  be  done  under  a  separate  assignment,  it  was 
never  performed.  Therefore,  the  Government  cannot  be  certain  that 
the  contractor  is  following  its  disclosed  practice  and  not  overcharging 
contracts  for  the  costs.  (Assignment  No.  981 1-2009A19100001) 

Nature,  Extent,  and 
Timing  of  the  Work 
to  be  Perfonned  to 
Accomplish  the 
Objectives 

AT  101.47 

The  auditor  did  not  properly  consider  the  nature,  extent,  and  timing  of  the 
work  to  be  performed  to  accomplish  the  objectives  of  the  engagement  in 
seven  examination  engagements. 

•  During  a  pre-award  accounting  system  examination  of  a  small 

contractor  with  $5 10,000  in  sales,  the  auditor  did  not  properly  define 
the  scope.  The  auditor  failed  to  verify  the  listing  of  current  contracts 
and  subcontracts  provided  by  the  contractor  and,  therefore,  missed 
including  the  contractor’s  subcontracts  with  the  U.  S.  Navy  and 
Department  of  Homeland  Security.  This  omission  unnecessarily 
limited  the  scope  of  the  engagement  and  resulted  in  the  auditor 
verifying  costs  to  a  project  that  was  not  representative  of  the  type  of 
subcontract  that  was  proposed.  (Assignment  No.  6431- 
2009B 177400 13) 

Planning  Deficiencies  Identified  with  GAGAS  Specific  Requirements 

Insufficient  Follow  up  on  Significant  Issues.  In  10  of  the  47  examination 
engagements,  the  auditor  did  not  follow  up  on  significant  findings  and  deficiencies 
identified  in  previous  engagements.  Specifically,  the  auditor  did  not  use  this  information 
in  assessing  risk  and  determining  the  nature,  timing,  and  extent  of  current  work,  including 
detennining  the  extent  to  which  testing  the  implementation  of  the  corrective  actions  is 
applicable  to  the  current  engagement  objectives.  GAGAS  6.09  states  that  auditors  should 
evaluate  whether  the  audited  entity  has  taken  appropriate  corrective  action  to  address 
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findings  and  recommendations  from  previous  engagements  that  could  have  a  material 
effect  on  the  subject  matter.  Examples  of  instances  where  the  auditor  failed  to  follow  up 
on  significant  findings  and  recommendations  from  previous  engagements  included: 

•  During  an  adequacy  of  disclosure  statement  examination  engagement  at  a 
contractor  with  total  sales  of  $320  million,  the  auditor  did  not  follow-up  on  a 
Cost  Accounting  Standard  noncompliance  identified  in  another  engagement. 
Specifically,  the  auditor  stated  that  the  noncompliance  would  be  addressed  in 
this  engagement.  However,  the  auditor  did  not  perform  any  work  to  detennine 
whether  the  noncompliance  currently  existed.  This  resulted  in  the  audit  office 
not  perfonning  work  needed  to  opine,  in  the  future,  on  the  contractor’s  general 
and  administrative  rate.  (Assignment  Number  98 1 1-2009A1 9 100001) 

•  During  a  $  1 5 1 .7  million  incurred  cost  examination  engagement,  the  auditor  did 
not  follow-up  and  report  on  expressly  unallowable  costs  that  were  a  significant 
portion  of  the  $3.8  million  in  questioned  indirect  expenses  identified  in  the 
subpackages  to  this  engagement.  Because  the  auditor  failed  to  follow-up  and 
recognize  the  costs  as  expressly  unallowable,  penalties  were  not  appropriately 
assessed  against  the  contractor.  (Assignment  Number  9851-2005F10100014) 

Failure  to  Obtain  a  Sufficient  Understanding  of  Internal  Controls.  In  9 

of  the  47  examination  engagements  reviewed,  the  auditor  did  not  obtain  a  sufficient 
understanding  of  internal  controls  to  properly  plan  the  examination  engagement. 

GAGAS  6.10  requires  the  auditor  to  obtain  such  an  understanding  of  internal  controls 
material  to  the  subject  matter  to  plan  the  engagement  and  design  procedures  to  achieve 
the  engagement  objectives.  An  understanding  of  the  relevant  internal  controls  is  needed 
to  detennine  the  appropriate  procedures  to  perform,  the  appropriate  evidence  needed,  and 
the  required  amount  of  testing.  For  instance,  in  an  incurred  cost  examination  engagement 
of  a  contractor  with  $78  million  in  sales,  the  auditor  did  not  complete  the  DCAA-required 
internal  control  questionnaire  which  documents  the  auditor’s  understanding  of  the 
contractor’s  basic  internal  controls.  Without  this  infonnation,  the  auditor  cannot 
complete  and  document  a  thorough  risk  assessment,  and  properly  plan  and  execute  the 
engagement.  Therefore,  there  is  a  potential  for  DCAA  to  have  accepted  and  the 
Government  to  have  reimbursed  the  contractor  for  unallowable  costs.  (Assignment 
Number  6 1 6 1  -2005 A 1 0 1 00022) 

New  Guidance  for  Documenting  Understanding  of  Internal  Controls.  In 

September  2011,  DCAA  issued  new  guidance  revising  its  process  for  documenting 
relevant  internal  controls  to  provide  a  better  link  between  the  risk  assessment,  including 
the  understanding  of  internal  controls,  and  the  decision  of  what  procedures  to  perfonn. 
DCAA  issued  the  revised  guidance  to  increase  compliance  with  GAGAS  6.10  and 
AT  601.45.  As  a  first  step  in  the  revised  process,  the  auditor  should  identify  the 


25  Supervisory  auditors  have  the  flexibility  to  subdivide  engagements  into  several  assignments.  When 
done,  one  assignment  is  the  overall  engagement  and  the  other  related  assignments  become  working  paper 
sections  of  the  overall  engagement  assignment.  The  assignments  that  act  as  working  paper  sections  are 
sometimes  called  ‘subpackages’  to  further  distinguish  them  from  engagement  assignments. 
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significant  cost  elements  or  subelements  (e.g.,  accounts  or  groups  of  accounts)  or  other 
areas  to  be  evaluated  based  on  materiality  and  other  inherent  risk  factors.  Next,  for  each 
of  those  areas,  the  auditor  should: 


•  consider  what  potential  noncompliances  could  occur; 

•  identify  and  document  the  key  policies  and  procedures  or  internal  controls  over 
compliance; 

•  document  previously  reported  deficiencies;  and 

•  tailor  the  procedures  accordingly  to  address  the  overall  risk. 

Previously  DCAA  documented  the  understanding  of  internal  control  primarily  by 
referencing  work  done  in  prior  audits  of  contractor  systems  and  related  internal  controls. 
DCAA  also  created  a  new  standard  electronic  working  paper  to  document  the  revised 
process  with  accompanying  instructions  for  completing  the  working  paper.  These 
revisions,  however,  will  not  impact  all  of  our  identified  noncompliances  with  GAGAS 
requirements  on  planning,  particularly  the  noncompliances  related  to  identifying  and 
documenting  the  relevant  criteria  and  materiality  and  sensitivity  factors.  We  have  not 
reviewed  the  implementation  of  the  revised  process,  but  we  will  monitor  its 
implementation  and  DCAA  improvement  in  the  areas  of  planning  and  risk  assessment 
through  our  continuous  oversight  of  DCAA. 

Planning  Deficiencies  Identified  with  DCAA  Guidance 

Inadequate  Coordination  on  Work  Performed  by  Others.  In  14  of  the 

47  examination  engagements  reviewed,  the  auditor  did  not  adequately  coordinate  with 
others.  The  DCAA  CAM  4-1003,  “Work  Performed  by  Others,”  states  that  an  important 
source  of  evidence  is  work  performed  by  other  DCAA  or  Government  auditors,  contract 
administration  officials,  independent  public  accountants,  contractor  internal  auditors  and 
non-auditors.  Thus  DCAA  guidance  emphasizes  the  importance  of  maintaining  effective 
communications  with  these  groups,  understanding  their  responsibilities,  and  knowing 
when  it  is  appropriate  to  request  their  assistance  or  rely  on  their  work.  Further, 
coordinating  with  these  groups  can  often  provide  additional  evidence  and  avoid 
duplication  of  effort. 

Coordination  with  Other  DCAA  Audit  Offices.  In  4  of  the  14  examination 
engagements,  the  auditor  did  not  coordinate  with  other  DCAA  auditors.  Due  to  the  lack 
of  coordination,  the  auditor  failed  to  obtain  relevant  evidence  needed  to  afford  a 
reasonable  basis  for  conclusions  and  recommendations.  For  instance,  during  a 
$1.9  billion  firm-fixed  price/cost-plus-fixed-fee  proposal  examination,  the  auditor  did  not 
request  an  assist  audit26  from  the  DCAA  audit  office  cognizant  of  the  proposed 


26  Assist  audits  occur  when  one  DCAA  auditor  at  one  location  is  furnished  assistance  in  the  form  of  a 
GAGAS-compliant  engagement  or  audit  by  a  DCAA  auditor  at  another  location.  DCAA  audit  offices 
perform  work  at  contractor  locations  within  a  defined  geographic  location  and  a  prime  contractor  may 
include  costs  not  supported  by  the  books  and  records  maintained  at  its  geographic  location.  DCAA  audit 
offices  generally  perform  assist  audits  on  subcontracts,  offsite  labor,  or  on  costs  that  are  allocated  from  or 
to  records  which  are  maintained  at  home  offices,  other  divisions,  segments,  cost  centers,  etc.  The  DCAA 
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subcontract  costs.  The  auditor  stated  that  an  assist  audit  of  the  $162  million  subcontract 
costs  would  be  requested;  however,  the  auditor  failed  to  execute  the  request  with  no 
explanation  as  to  why  this  was  not  done.  Therefore,  DCAA  accepted  the  $  162  million  in 
proposed  subcontract  costs,  possibly  resulting  in  the  Government  paying  the  contractor 
more  than  necessary  on  the  subcontract.  (Assignment  Number  3531-2009L2100001 1) 

Work  of  Internal  or  External  Auditors.  In  10  of  the  47  examination 
engagements,  the  auditor  did  not  appropriately  consider  procedures  performed  by 
contractor  internal  or  external  auditors  in  detennining  the  nature,  timing,  and  extent  of 
the  procedures  to  be  performed.  The  DCAA  CAM  4-202,  “Relationships  with  Contractor 
Internal  and  External  Auditors,”  states  that  when  contractors  make  internal  or  external 
reports  available  to  DCAA,  the  auditor  should  review  the  reports  to  detennine  if  there  are 
any  reported  items  that  need  follow-up  or  affect  in-process  examinations.  Due  to  this 
lack  of  consideration,  the  auditor  did  not  address  the  potential  for  opportunities  in 
planning  and  performing  the  examination  in  coordination  with  the  external  or  internal 
auditors  to  avoid  duplication  and  reduce  overall  costs  to  the  entity  and  the  Government. 
Examples  of  instances  where  the  auditor  did  not  consider  procedures  perfonned  by 
contractor  internal  or  external  auditors  included: 

•  During  a  floor  check  examination  engagement  at  a  large  contractor,  the  auditor 
did  not  request  contractor  internal  audits  of  the  labor  system  as  required  by  the 
standard  audit  program.  Instead,  the  auditor  documented  that  a  prior  audit  was 
qualified  stating  that  it  is  contractor  policy  not  to  provide  DCAA  with  its  internal 
audit  working  papers.  As  a  result,  the  auditor  did  not  determine  whether  any 
relevant  contractor  internal  audit  reports  existed  and  request  them.  The  auditor 
should  have  used  infonnation  in  the  contractor  internal  audit  reports  to  determine 
whether  additional  risk  factors,  especially  relating  to  potential  fraud,  existed. 
Without  this  infonnation,  the  auditor  was  not  sure  that  all  appropriate  procedures 
were  perfonned.  Refusal  of  a  contractor  to  provide  its  internal  audit  working 
papers  does  not  relieve  the  auditor  from  determining  what  internal  audit  reviews 
have  been  perfonned  and  obtain  any  information  on  them  that  the  contractor  is 
willing  to  provide.  (Assignment  Number  621 1-2009C13500003) 

•  During  an  internal  control  examination  of  a  labor  accounting  system  that 
processed  $81  million  in  2008,  the  auditor  obtained  a  copy  of  a  contractor  internal 
audit  report  which  concluded  that  adherence  to  timecard  and  labor  input  controls 
remained  inadequate.  The  auditor  failed  to  evaluate  the  contractor  internal  audit 
report  and  determine  its  effect  on  procedures  performed  in  this  engagement. 
Therefore,  the  auditor  may  not  have  perfonned  the  most  appropriate  procedures 
resulting  in  an  inefficient  use  of  resources  and  failure  to  identify  potential  fraud 
indicators.  (Assignment  Number  3191-2009F13010001) 


audit  office  cognizant  of  the  prime  contractor  is  responsible  for  identifying  the  elements  of  cost  requiring 
assist  audits  and  requesting  the  assist  audits. 
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Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

9.  Review  the  electronic  standard  working  paper  software  and  documents  in 
the  “Audit  Planning  &  Performance  System”  to  determine  appropriate 
revisions  to  prompt  auditor  compliance  with  government  auditing  standards 
and  Defense  Contract  Audit  Agency  policies  and  procedures  such  as: 

a.  Require  the  listing  of  specific  criteria  in  the  source  section  of  each 
working  paper. 

DCAA  Comments 

DCAA  agreed.  DCAA  stated  that  it  would  revise  its  Audit  Planning  and  Performance 
System  to  require  the  identification  of  criteria  specific  to  an  evaluation  in  the  applicable 
working  paper  by  December  31,  2012. 

Our  Response 

DCAA  comments  were  responsive.  On  September  19,  2012,  DCAA  provided  an 
example  of  the  on-page  note  generated  by  the  Audit  Planning  and  Performance  System 
and  the  update  to  DCAA  Contract  Audit  Manual  Chapter  4-403 g(4)  requiring  the  auditor 
to  document  in  the  scope  of  analysis  the  specific  criteria  used  to  make  judgments  and 
conclusions.  No  additional  comments  are  required. 

b.  Revise  all  standard  risk  assessment  working  papers  to  require  the  auditor 
to  list  the  factors  used  to  determine  the  materiality  and  sensitivity  of  the 
assignment. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  the  current  DCAA  risk  assessment 
working  papers  (DCAA  standard  working  paper  B)  for  all  assignments  already  require 
the  auditor  to  document  significant  materiality  and  sensitivity  factors  and  assess  the  effect 
of  those  factors  on  the  assertion  and  cost  elements  under  review.  DCAA  considers  this 
action  complete. 

Our  Response 

DCAA  comments  were  partially  responsive  to  the  intent  of  the  recommendation.  On 
September  19,  2012,  October  4,  2012,  and  October  31,  2012,  DCAA  provided  the 
standard  risk  assessment  working  papers  for  all  examination  assignments  as  generated 
from  the  Audit  Planning  and  Performance  System.  DCAA  also  responded  to  follow-up 
questions  about  their  use  and  content.  Most  of  the  standard  risk  assessment  working 
papers  include  a  section  to  document  materiality  and  sensitivity  factors  and  also  provide  a 
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listing  of  factors  to  consider  when  completing  this  working  paper  section.  However, 
DCAA  uses  a  generic  risk  assessment  working  paper  for  numerous  examination-level 
assignments  that  does  not  include  a  section  to  document  and  plan  for  materiality  and 
sensitivity  factors.  Some  audit  assignments  that  use  the  generic  standard  risk  assessment 
working  paper  include  those  for  performing  concurrent  incurred  cost  audits,  progress 
payment  audits,  and  some  cost  accounting  standards  audits.  Including  a  listing  of  factors 
to  consider  is  not  sufficient  implementing  guidance  without  a  description  or  explanation 
of  the  individual  factors.  For  instance,  the  DCAA  Contract  Audit  Manual  Chapter  3-104 
includes  a  detailed  discussion  of  individual  factors  affecting  audit  scope  that 
encompasses  many  of  the  materiality  and  sensitivity  factors  that  are  listed  on  the  standard 
generic  risk  assessment  working  paper.  Adding  a  reference  to  the  applicable  DCAA 
Contract  Audit  Manual  on  the  risk  assessment  working  paper  would  provide  supporting 
information  for  auditors  to  use  when  completing  this  important  step  in  audit  planning. 

We  request  that  DCAA  to  provide  additional  comments  in  response  to  the  final  report, 
giving  further  consideration  to  including  a  working  paper  section  on  documenting  and 
planning  for  materiality  and  sensitivity  factors. 


c.  Add  a  procedure  to  the  concluding  steps  to  remind  the  auditor  that 
additional  procedures  need  to  be  considered  and  performed  when 
internal  control  deficiencies  or  potential  fraud,  illegal  acts,  abuse,  or 
violations  of  contract  provisions  are  identified. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  it  issued  guidance  on  reporting  business 
system  deficiencies  in  MRD  12-PAS-012  on  April  24,  2012,  and  revised  applicable 
standard  audit  programs  to  include  planning  meetings  with  the  audit  team  to  discuss  risk 
of  fraud  and  other  noncompliances  as  a  risk  assessment  procedure.  DCAA  also  stated 
that  audit  procedures  to  test  the  contractor’s  compliance  with  applicable  laws, 
regulations,  and  contract  terms  exist  throughout  the  audits  and  contractor  compliance 
with  these  criteria  is  the  primary  objective  of  most  DCAA  audits.  DCAA  considers  the 
actions  to  address  this  recommendation  complete. 

Our  Response 

DCAA  comments  were  generally  responsive.  No  additional  comments  are  required.  As 
part  of  our  followup  and  monitoring  responsibilities,  we  will  consider  whether  the 
guidance,  revised  programs,  and  audit  procedures  are  sufficient. 

Auditor  Communication  During  Planning 

DCAA  Policies  Not  in  Compliance  with  GAGAS 

In  all  of  the  47  examination  engagements  reviewed,  DCAA  did  not  comply  with  GAGAS 
requirements  for  auditor  communication  during  planning.  GAGAS  6.07  requires  the 
auditor  to  communicate  certain  infonnation,  including  the  auditor’s  understanding  of  the 
services  to  be  perfonned  for  the  engagement,  in  writing,  to  entity  management,  those 
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charged  with  governance,  and  to  the  individuals  contracting  for  or  requesting  the 
engagement.  The  required  infonnation  includes: 


•  nature,  timing,  and  extent  of  planned  testing  and  reporting; 

•  the  level  of  assurance  the  auditor  will  provide;  and 

•  any  potential  restriction  on  the  auditors’  report,  to  reduce  the  risk  that  the  needs  or 
expectations  of  the  parties  involved  may  be  misinterpreted. 

Communication  of  specific  information  in  relation  to  attestation  engagements  is 
particularly  important.  Therefore,  GAGAS  and  AICPA  standards  emphasize  use  of 
written  communication  to  reduce  the  risk  that  the  needs  or  expectations  of  the  parties 
involved  are  misinterpreted.  The  majority  of  the  deficiencies  occurred  because  the 
applicable  DCAA  guidance  did  not  adequately  cover  the  GAGAS  requirements  for 
written  communication  with  the  contractor  representative  (entity  management)  or  the 
contracting  officer  (requester)  of  the  attestation  engagement. 

Written  Communication  with  Contractor  Management  Not 
Compliant  with  GAGAS  Requirements 

DCAA  did  not  comply  with  GAGAS  6.07  requirements  to  communicate,  in  writing, 
certain  specific  information  to  contractor  management.  Communication  of  certain 
information  regarding  the  scope  of  the  engagement  and  timeline  for  performance  of  and 
reporting  on  the  engagement  is  of  particular  importance  to  contractor  management. 
Putting  the  infonnation  in  writing  helps  to  avoid  potential  misunderstandings  between  the 
auditor  and  the  contractor  regarding  the  engagement.  Examples  of  noncompliances 
related  to  written  communication  included: 

•  In  47  examination  engagements,  the  auditor  did  not  provide  the  contractor  written 
notification  of  potential  report  restrictions. 

•  In  45  of  the  47  examination  engagements,  the  auditor  did  not  inform,  in  writing, 
the  contractor  of  the  level  of  assurance  to  be  provided  in  the  report. 

•  In  39  of  the  47  examination  engagements,  the  auditor  failed  to  provide  the 
contractor  information,  in  writing,  on  the  nature,  timing,  or  extent  of  planned 
testing  or  reporting. 

DCAA  guidance  in  effect  during  our  review  provided  that  the  auditor  should 
communicate  the  GAGAS -required  infonnation  to  a  representative  of  the  organization 
audited  such  as  the  audit  liaison,  corporate  controller,  or  chief  financial  officer.  This 
DCAA  policy,  however,  did  not  require  the  auditor  to  provide  the  infonnation  in  writing. 
Also,  while  standard  audit  programs  prompted  the  auditor  to  hold  an  entrance  conference 
with  the  contractor’s  representative,  they  did  not  mention  the  requirement  to  provide  the 
information  to  the  contractor  in  writing.  For  an  entrance  conference,  CAM  4-302.1. a. 
only  told  the  auditor  to  “document  the  date,  participant’s  names  and  title,  and  primary 
discussion  points,  including  specific  identification  of  the  requested  data  to  control  what 
was  requested  and  provided  during  the  audit.”  Therefore,  the  DCAA  policy  and 
procedures  did  not  adequately  direct  the  auditor  to  perform  all  required  activities  needed 
to  comply  with  the  GAGAS  requirements  for  auditor  communications. 
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Communications  with  Requester  Not  Fuiiy  Compliant  with 
Requirements  and  DCAA  Guidance 

In  38  examination  engagements  reviewed,  DCAA  did  not  comply  with  GAGAS  6.07 
requirements  to  communicate,  in  writing,  certain  specific  information  to  the  requester  or 
contracting  official.  For  instance: 

•  In  22  of  the  47  examination  engagements,  the  auditor  did  not  provide  the 
requester  or  contracting  official  information,  in  writing,  on  the  nature,  timing,  or 
extent  of  planned  testing  or  reporting. 

•  In  32  of  the  47  examination  engagements,  the  auditor  did  not  infonn,  in  writing, 
the  requester  or  contracting  official  of  the  level  of  assurance  to  be  provided  in  the 
report. 

•  In  36  of  the  47  examination  engagements,  the  auditor  did  not  provide  the 
requester  or  contracting  official  written  notification  of  potential  report  restrictions. 

Auditors  did  not  always  comply  with  DCAA  guidance  for  written  notification  to 
contracting  officials  and  related  GAGAS  requirements.  We  found  noncompliances  in  all 
20  self-initiated  or  non-requested  engagements. 

•  In  13  of  the  20  self-initiated  or  non-requested  examination  engagements,  the 
auditor’s  written  notification  to  the  contracting  official  did  not  include  all  content 
required  by  DCAA  guidance. 

•  In  7  of  the  20  self-initiated  or  non-requested  examination  engagements,  the 
auditor  did  not  issue  any  written  notification  to  the  contracting  official. 

Written  communication  with  the  requester  or  user  is  particularly  important  to  ensure  that 
the  requester  or  user  fully  understands  the  level  of  assurance  to  be  provided  and  when  it 
will  be  received.  This  information  allows  the  requester  or  user  to  manage  the  remainder 
of  the  negotiation  or  contract  administration  process  and  ultimately  meet  the  end  user’s 
needs. 

DCAA  guidance  for  communication  with  the  requester  or  contracting  official  in  effect 
during  our  review  required  the  auditor  to  send  an  acknowledgment  letter  in  a  timely 
manner  in  response  to  requests  for  audit  services  received  from  a  customer.  The  auditor 
was  also  directed  to  send  a  notification  letter  to  the  planned  recipient  of  the  report  for 
engagements  that  have  not  been  requested  or  are  self-initiated  such  as  incurred  cost 
audits,  internal  control  system  audits,  and  post-award  audits.  The  content  of  the 
acknowledgment  or  notification  was  to  include  the  assignment  number  and  type;  scope, 
objectives,  and  key  procedures;  opportunity  for  customer  concerns  or  feedback  on  the 
planned  scope;  whether  technical  assistance  was  required;  information  about  in-process 
communication;  and  the  planned  report  date.  The  guidance  also  included  examples  of 
acknowledgment  and  notification  letters  to  illustrate  the  communication  requirements. 
The  majority  of  the  deficiencies  we  identified,  however,  related  to  not  providing  the 
requester  or  the  contracting  official  a  clear  explanation  of  the  level  of  assurance  to  be 
provided  or  the  potential  report  restrictions.  These  criteria  were  not  specifically  part  of 
the  acknowledgment  or  notification  letter  content  in  the  DCAA  guidance. 
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Revised  DCAA  Guidance  on  Written  Communications  Needs 
Further  Improvements 

From  September  2010  through  June  2012,  DCAA  made  incremental  improvements  in  its 
guidance  on  written  communications.  In  FY  2010,  DCAA  issued  guidance  reminders  to 
audit  offices  of  the  requirement  to  send  an  acknowledgement  or  notification  letter  to  the 
contracting  official  and  contractor  representative  for  each  engagement  and  further 
clarified  its  guidance  in  FY  2011.  As  of  June  2012,  all  standard  audit  programs 
contained  a  step  for  providing  the  GAGAS-required  written  notification  to  the  contractor 
and  the  contracting  officials.  Additional  guidance  revisions  are  still  needed  to  improve 
audit  office  compliance  with  GAGAS. 

DCAA  first  reminded  audit  offices  of  the  requirement  to  issue  an  acknowledgement  or 
notification  letter  in  its  September  9,  2010,  The  Rules  of  Engagement,  guidance. 
However,  this  guidance  did  not  address  the  deficiencies  we  identified  in  the  infonnation 
provided  to  the  requester  or  user.  Additionally,  it  did  not  require  the  audit  offices  to 
provide  the  same  information  provided  to  the  requester  to  the  contractor,  in  writing,  as 
required  by  GAGAS.  On  December  15,  2010,  DCAA  instructed  its  auditors  to 
immediately  issue  a  notification  letter  to  the  contractor  for  all  new  engagements  and 
those  currently  in  the  planning  phase.  The  guidance  also  emphasized  that  the  auditor 
should  ensure  that  an  acknowledgement  or  notification  letter  was  issued  to  the 
contracting  official  for  all  engagements,  including  self-initiated  or  non-requested  ones. 
The  examples  provided  to  the  audit  offices  of  an  acknowledgement  or  notification 
memorandum  to  be  sent  to  the  contracting  official  and  the  notification  letter  to  be  sent  to 
the  contractor  generally  included  the  GAGAS-required  infonnation. 

On  August  19,  201 1,  DCAA  revised  the  CAM  guidance  and  moved  the 
acknowledgement  and  notification  letters  examples  from  the  CAM  to  the  standard 
electronic  working  paper  packages  and  its  intranet  library.  Additionally,  as  of  June  2012, 
DCAA  revised  all  applicable  standard  audit  programs  to  include  steps  for  sending  both 
contractor  notification  letters  and  contracting  official  acknowledgement  or  notification 
letters  as  part  of  the  preliminary  steps.  However,  to  be  consistent  with  GAGAS,  the 
acknowledgement  or  notification  memorandum  to  the  contracting  official  and  the 
notification  letter  to  the  contractor  should  clearly  state  that  the  level  of  assurance 
provided  by  an  examination  engagement  is  “. .  .to  obtain  reasonable  assurance  about 
whether. .  .are  free  of  material  misstatement.”  DCAA  guidance  should  also  require  the 
auditor  to  identify  the  nature  of  the  engagement  as  an  examination  engagement.  The 
previous  examples  incorrectly  use  the  term  “audit”  instead  of  “examination.” 


Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 
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10.  Revise  the  guidance  and  examples  of  Acknowledgement  and  Notification 
Letters  to  comply  with  generally  accepted  government  auditing  standard 
paragraph  6.07  on  auditor  communication  during  planning. 

DCAA  Comments 

DCAA  agreed.  DCAA  stated  that  it  revised  the  acknowledgement  and  notification  letters 
in  the  Audit  Planning  and  Performance  System  on  September  10,  2012,  to  state  that  an 
examination-level  attestation  engagement  will  be  performed.  DCAA  considers  actions 
taken  to  address  this  recommendation  as  complete. 

Our  Response 

DCAA  comments  were  responsive.  On  September  21,  2012,  DCAA  provided  the  revised 
letters  that  are  now  being  delivered  in  the  Audit  Performance  and  Planning  System.  No 
additional  comments  are  required. 

Evidence 

Insufficient  Evidence  Obtained  to  Address  Engagement 
Objectives 

In  36  of  the  47  examination  engagements,  the  auditor  did  not  obtain  sufficient, 
appropriate  evidence  to  address  engagement  objectives  and  support  significant  judgments 
and  conclusions.  Auditors  should  determine  the  overall  sufficiency  and  appropriateness 
of  evidence  needed  to  provide  a  reasonable  basis  for  the  findings  and  conclusions. 
Specifically,  the  auditor  did  not  perform  enough  testing,  complete  planned  procedures,  or 
use  the  correct  criteria  during  testing.  GAGAS  6.04b  requires  the  auditor  to  obtain 
sufficient  evidence  to  provide  a  reasonable  basis  for  the  conclusion  expressed  in  the 
report.  Furthennore,  GAGAS  6.15  requires  that  when  deficiencies  are  identified,  the 
auditor  should  plan  and  perform  procedures  to  develop  the  elements  of  the  findings 
(criteria,  condition,  cause  and  effect)  that  are  relevant  and  necessary  to  achieve  the 
engagement  objectives.  On  May  2,  2012,  DCAA  issued  MRD  12-PAS-015(R),  “Audit 
Guidance  on  Performing  Sufficient  Testing,”  which  covered  risk  assessment  procedures, 
tests  of  controls  and  substantive  procedures,  sufficient  appropriate  evidence,  selecting 
items  for  testing,  and  documentation  requirements.  The  guidance  also  contained  three 
example  scenarios  of  sufficient  testing  and  procedures  for  testing  estimates  based  on 
unaudited  historical  data.  We  have  not  reviewed  the  effectiveness  of  this  guidance  on 
DCAA  compliance  with  GAGAS;  however,  we  will  monitor  improvement  in  this  area 
through  our  continuous  oversight  of  DCAA. 

Sufficiency  of  Evidence 

In  detennining  sufficiency  of  evidence,  auditors  should  evaluate  whether  enough 
appropriate  evidence  exists  to  address  the  examination  objectives  and  support  the 
findings  and  conclusions.  Failure  to  obtain  sufficient  evidence  resulted  in  unsupported 
findings  and  conclusions.  Examples  of  insufficient  evidence  included: 
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•  During  a  $  1 5 1 .7  million  incurred  cost  examination  engagement,  the  auditor  relied 
solely  on  insufficient  testing  of  $81.6  million  in  direct  labor  costs  performed  in  a 
separate  engagement  to  detennine  whether  the  labor  costs  were  acceptable.  The 
scope  of  the  separate  engagement  was  limited  to  performing  a  floor  check  of  3 1 
out  of  800  employees.  Failure  to  perform  additional  testing  of  the  claimed 
$81.6  million  in  labor  costs  during  the  incurred  cost  audit  and  relying  on  the 
insufficient  testing  performed  in  the  separate  engagement  caused  the  auditor  to 
inappropriately  accept  all  of  the  claimed  incurred  labor  costs  as  allowable  for  final 
payment  by  the  Government.  (Assignment  Number  985 1-2005F10100014) 

•  During  a  forward  pricing  rate  proposal  examination  engagement  performed  at  a 
contractor  with  total  sales  of  $132.9  million,  the  auditor  tested  only  one  of  seven 
proposed  rates,  but  expressed  an  opinion  on  all  of  the  rates.  Also,  the  auditor  did 
not  adequately  review  one  indirect  rate  which  had  proposed  base  year  expenses  of 
approximately  $  1  million.  The  auditor  failed  to  update  the  analysis  of  proposed 
indirect  costs  with  actual  costs  that  were  available  prior  to  the  report  issuance. 
Therefore,  the  work  performed  did  not  provide  an  acceptable  basis  for  the 
Government  to  use  when  negotiating  contracts  with  the  contractor  potentially 
resulting  in  a  contracting  officer  unnecessarily  spending  Government  funds. 
(Assignment  Number  265 1-2009H23000006) 

Statistical  and  Nonstatistical  Samples 

Statistical  Sampling  Plans 

In  seven  of  eight  examination  engagements  using  statistical  sampling,  the  auditor  did  not 
use  an  appropriate  confidence  level  in  the  statistical  sampling  plan.  Specifically,  the 
auditor  used  a  confidence  level  of  less  than  90  percent  that  resulted  in  a  sample  size  for 
transaction  testing  that  was  too  small.  As  a  result,  potential  deficiencies  and  questioned 
costs  were  not  identified  or  reported,  and  the  Government  could  have  reimbursed  the 
contractor  for  unallowable  costs.  Examples  of  insufficient  testing  that  resulted  from 
inadequate  statistical  sampling  plans  included  the  following: 

•  During  a  $102.3  million  incurred  cost  examination  engagement,  the  auditor  used  a 
70  percent  confidence  level  and  50  percent  error  rate28  in  the  statistical  sample  of 
indirect  expenses.  In  one  sample,  the  auditor  only  selected  4  out  of  5 1  items 
representing  25  percent  of  the  costs  charged  for  human  resource  benefits. 
(Assignment  Number  6151 -2007N 101 0000 1 ) 


27  The  confidence  level  is  the  assurance  or  probability  that  the  amount  being  estimated  by  the  sample  will 
fall  within  a  specified  range  (or  interval)  determined  by  the  sample  results.  A  confidence  level  is 
commonly  defined  as  the  point  estimate  plus  or  minus  the  precision  amount.  For  instance,  a  90  percent 
confidence  level  indicates  that  with  repeated  sampling  under  the  same  sampling  plan,  90  times  out  of  100, 
the  actual  universe  amount  is  expected  to  be  within  the  interval  computed  from  the  sample  results.  In 
practical  terms,  this  means  that  any  single  sample  has  a  90  percent  chance  of  producing  a  result,  in  this  case 
cost  questioned,  that  is  the  actual  amount  in  the  universe. 

28  The  error  rate  refers  to  the  expected  amount  of  dollar  errors  found  in  the  universe. 
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•  During  a  $96  million  firm- fixed  price  proposal  examination  engagement,  the 
auditor  used  a  70  percent  confidence  level  and  25  percent  error  rate  in  the 
statistical  sampling  plan  to  review  the  proposed  $25.8  million  bill  of  material, 
which  resulted  in  an  insufficient  sample  and  limited  testing  to  28  of  the  507  items. 
(Assignment  Number  3561-2009D21000013) 

DOD  IG  Audit  Policy  and  Oversight  issued  APO  Memo  No.  2010-CAPO-005, 
“Adequacy  of  Defense  Contract  Audit  Agency  Statistical  Sample  Plans,”  on 
May  28,  2010,  that  recommended  the  appropriate  use  of  statistical  sampling  applications 
to  ensure  that  sufficient  evidence  is  obtained.  Specifically,  APO  recommended  the  use  of 
a  minimum  of  90  percent  confidence  level  in  statistical  sampling  applications  for 
variables;  revision  of  DCAA  CAM  guidance  and  fonnal  training  courses  and  materials; 
and  training  for  all  audit  staff.  In  response  to  our  recommendations,  DCAA  revised  their 
guidance  by  issuing  MRD  10-OTS-051(NR),  “Guidance  on  Variable  Sampling  Policy,”29 
dated  August  31,  2010,  and  MRD  10-OTS-069(R),  “Attribute  Sampling  Policy,”  dated 
October  20,  2010,  which  incorporated  the  use  of  a  90  percent  confidence  level  in 
determining  sample  sizes.  These  guidance  documents  also  addressed  reporting  sample 
results  in  reports.  We  have  not  reviewed  the  implementation  of  this  guidance;  however, 
we  will  monitor  improvement  in  this  area  through  our  continuous  oversight  of  DCAA. 

Nonstatistical  Sampling  Plans 

In  9  of  the  23  examination  engagements  30  reviewed  that  used  nonstatistical  sampling,31 
the  auditor  did  not  have  a  nonstatistical  sampling  plan  for  the  selection  of  items  for 
testing.  Due  to  the  auditor  not  using  the  criteria  outlined  in  MRD  09-PAS-003,  “Audit 
Guidance  on  Working  Paper  Documentation  of  Judgmental  Selections,”  dated 
January  30,  2009,  the  auditor  did  not  develop  an  adequate  sampling  plan  and  select  a 
sufficient  number  of  transactions  for  testing.  Therefore,  the  Government  may  have 
reimbursed  the  contractors  for  unallowable  costs  or  negotiated  a  higher  contract  value 
than  it  should  have.  Examples  of  insufficient  testing  that  resulted  from  inadequate 
nonstatistical  sampling  plans  included: 

•  During  a  $16.4  million  incurred  cost  examination  engagement,  the  auditor  did  not 
use  an  appropriate  nonstatistical  sampling  plan  for  testing  incurred  labor  costs. 
This  deficiency  resulted  in  the  auditor  evaluating  roughly  1  percent  of  the  total 
direct  labor  costs  ($64,349  of  $5.4  million).  The  auditor  did  not  identify  the  total 
universe  for  direct  labor  costs  as  $5.4  million,  or  the  total  number  of  contractor 
employees.  Instead,  the  auditor  used  a  direct  labor  cost  universe  of  $2. 1  million 


29  DCAA  later  reissued  this  guidance  as  MRD  1  l-OTS-OOl(R)  on  January  3,  2011,  to  allow  the  document 
to  be  released  to  the  general  public.  The  guidance  itself  did  not  change. 

30  In  some  of  the  47  examination  engagements  reviewed,  the  auditor  did  not  use  sampling  methods  because 
the  nature  of  the  assignment  did  not  require  transaction  testing  (e.g.  forward  pricing  rate  proposal  and  CAS 
compliance  reviews),  the  auditor  failed  to  perform  transaction  testing,  or  the  auditor  relied  solely  on  testing 
performed  in  other  assignments. 

31  This  refers  to  reviewing  less  than  100  percent  of  the  transactions  but  not  statistically  projecting  the  result 
to  the  transaction  universe. 
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that  represented  direct  labor  claimed  on  only  4  high  dollar  contracts.  To  make 
matters  worse,  the  auditor  then  only  tested  3  percent  ($64,349  out  of  $2.1  million) 
of  the  misidcntilied  direct  labor  cost  universe  by  testing  only  8  employees’ 
charges  for  just  2  pay  periods.  (Assignment  Number  6 1 6 1  -2005 A 1 0 1 00022) 

•  During  a  $41.2  million  cost  realism  proposal  examination  engagement,  the  auditor 
did  not  identify  the  universe  of  transactions  in  the  4  accounts  selected  or  the  basis 
for  the  account  selection.  The  auditor  also  gathered  insufficient  evidence  to 
achieve  the  engagement’s  objectives  because  the  auditor  did  not  address 
differences  identified  between  the  contractor’s  submission  and  the  general  ledger. 
When  the  submission  and  general  ledger  accounts  do  not  reconcile,  the 
Government  is  not  assured  that  the  contractor  was  only  reimbursed  actual 
allowable  costs.  (Assignment  Number  352 1-20 10V27000003) 

Failure  to  Perform  Sufficient  Work  to  Achieve  Objectives 

In  some  reviewed  examination  engagements,  the  auditor  failed  to  perform  sufficient  work 
to  achieve  all  of  the  engagement  objectives  because  some  of  the  procedures  were  not 
perfonned  or  not  performed  properly.  GAGAS  6. 15  states  that  a  finding  or  a  set  of 
findings  is  complete  to  the  extent  that  the  engagement  objectives  are  satisfied.  For 
instance,  during  the  testing  of  claimed  consultant  fees  in  a  $681,000  incurred  cost 
examination  engagement,  the  auditor  did  not  identify  that  a  consulting  agreement  was 
only  valid  for  90  days.  The  contractor  claimed  $14,243  for  services  performed  on  the 
contract  for  the  entire  year.  One  engagement  objective  was  to  detennine  the  allowability 
of  the  claimed  costs.  Because  the  auditor  did  not  test  the  claimed  costs  against  key 
criteria  such  as  time  limitations,  the  auditor  did  not  fully  satisfy  the  objective.  The 
Government  overpaid  the  contractor  $12,229  in  consultant  fees.  (Assignment  Number 
4171 -2006G 101 00007) 

Insufficient  Evidence  to  Support  Internal  Control  System 
Reviews 

DCAA  did  not  obtain  and  analyze  sufficient  evidence  to  support  the  findings  and 
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conclusions  in  five  of  the  six  ~  internal  control  system  examination  engagements  we 
reviewed.  The  auditors  did  not  perform  sufficient  compliance  testing  on  all  relevant 
control  objectives  and  did  not  perfonn  all  procedures  needed  to  address  the  engagement 
objectives.  The  GAO  also  reported  similar  testing  deficiencies  in  its  September  2009 
Report  No.  GAO-09-468,  “Widespread  Problems  with  Audit  Quality  Require  Significant 
Reform.”  DCAA  uses  the  results  from  various  internal  control  system  reviews  when 
planning  related  engagements  involving  the  same  contractor.  Therefore,  inadequately 
perfonned  internal  control  system  reviews  negatively  impact  DCAA’s  compliance  with 
GAGAS  6.10  and  6.11  requirements  to  obtain  a  sufficient  understanding  of  internal 
control  and  resulted  in  insufficient  testing  in  assignments  that  relied  on  the  results  of 
these  reviews.  Examples  of  inadequate  internal  control  system  reviews  included: 


32  DCAA  did  not  perform  one  of  the  seven  internal  control  system  examination  engagements.  Assignment 
Number  1261-2010A12030001,  as  an  internal  control  system  review.  Therefore,  we  did  not  include  the 
deficiencies  identified  in  this  engagement  in  this  report  section. 
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•  In  an  examination  engagement  of  a  labor  accounting  system  that  processed 
$81  million,  the  auditor  performed  limited  or  insufficient  testing  of  internal 
controls  for  seven  out  of  eight  control  objectives.  Control  objectives  not  tested 
included  Employee  Awareness  Training,  Labor  Authorization  Approvals,  Manual 
or  Automated  System,  Labor  Distribution,  Labor  Cost  Accounting,  Payroll 
Preparation  and  Payment,  and  Labor  Transfers  and  Adjustments.  Therefore, 
DCAA  needs  to  increase  its  testing  of  direct  and  indirect  labor  costs  during  other 
engagements  to  ensure  that  the  Government  reimbursed  the  contractor  only  for 
allowable  costs.  (Assignment  Number  3191 -2009F 1301 0001) 

•  In  an  examination  engagement  of  a  billing  system  that  processed  $4.3  billion,  the 
auditor  did  not  test  internal  controls  for  a  key  control  objective,  Implementation 
of  Policies  and  Procedures.  DCAA  determined  that  the  contractor’s  billing 
system  was  inadequate;  therefore,  the  contractor  cannot  bill  the  Government 
without  DCAA  provisionally  approving  cost  vouchers.  However,  failure  to 
identify  all  potentially  significant  system  deficiencies  further  delays  the  contractor 
implementing  an  adequate  billing  system.  (Assignment  Number  2641- 

2009C1 1010001) 

•  In  an  examination  engagement  of  an  indirect  and  other  direct  cost  system  that 
processed  $708  million,  the  auditor  inappropriately  relied  on  testing  performed  in 
other  engagements  for  key  control  objectives.  The  auditor  did  not  verify  that  the 
referenced  engagements  contained  sufficient  testing  for  the  Preparation  of  Indirect 
and  Other  Direct  Cost  Submissions,  Identification  of  Unallowables,  and 
Allocability  of  Indirect  and  Other  Direct  Costs  control  objectives.  Our  review  of 
the  other  engagements  disclosed  that  sufficient  appropriate  testing  for  those 
control  objectives  was  not  perfonned  in  the  referenced  engagements  and  is  not 
generally  performed  in  those  types  of  engagements.  The  audit  office  will  need  to 
significantly  increase  its  testing  of  indirect  and  other  direct  costs  on  all 
engagements  perfonned  at  this  contractor.  (Assignment  Number  1721- 

2009B 14980001) 
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•  During  the  control  environment  system  examination  engagement  of  a  contractor 
with  $674.4  million  in  LY  2009  Government  sales,  the  auditor  identified  that  the 
contractor  was  not  including  the  mandatory  disclosure  clause  in  its  subcontracts 
and  may  not  be  performing  periodic  compliance  reviews  of  its  code  of  business 
ethics  and  conduct.  Lailure  to  perform  either  action,  as  required  by  Lederal 
Acquisition  Regulation  Subpart  52.203-13,  reflects  on  the  contractor’s  attitude 
toward  its  required  responsibilities  to  identify  and  disclose  violations  of  laws  and 
to  establish  an  overall  ethical  business  environment.  Therefore,  the  potential  non- 
compliances  identified  in  the  engagement  should  be  considered  a  fraud  indicator 
and  should  significantly  increase  the  fraud  risk  when  perfonning  other 
examination  engagements.  The  auditor  did  not  perform  additional  work  to  fully 
develop  and  report  the  findings.  Instead,  audit  office  management  decided  to 


33  DC  AA  combines  the  reviews  of  the  accounting  system  and  the  overall  control  environment  system  in  one 
standard  audit  program.  The  audit  office  decided  to  perform  only  the  overall  control  environment  system 
review  in  the  assignment  we  reviewed. 


41 


issue  the  report  in  February  2010  with  an  overall  inadequate  opinion  based  on 
other  identified  deficiencies  and  address  the  additional  issues  in  a  supplemental 
report.  However,  the  audit  office  did  not  perfonn  the  additional  work  and,  in 
response  to  our  inquiry,  stated  that  they  would  start  a  follow-up  assignment  by 
December  31,2011.  During  the  time  period  since  the  report  was  issued,  the  audit 
office  canceled  three  accounting  system  reviews,  any  one  of  which  could  have 
covered  the  additional  work  needed  on  the  control  environment.  DCAA  should 
complete  the  work  required  to  develop  and  report  all  significant  control 
environment  system  deficiencies  in  a  timely  fashion.  Deficiencies  identified  in  a 
contractor’s  control  environment  impact  the  amount  and  type  of  testing  performed 
on  all  engagements  involving  the  contractor.  (Assignment  Number  3311- 
2008C1 1070001) 

Revised  DCAA  Approach  for  Internal  Control  System  Reviews 

In  FY  2010,  based  on  a  previously  proposed  revision  to  the  Defense  Federal  Acquisition 
Regulation  Supplement  4  and  the  legislative  requirements  regarding  contractor  business 
systems,  DCAA  began  to  restructure  the  internal  control  reviews  it  performed,  drafted 
new  audit  programs,  and  started  testing  new  audit  programs  for  evaluating  internal 
controls  at  1 1  pilot  sites.  DCAA  combined  the  planning  and  budgeting  system  review 
with  the  estimating  system  review;  the  compensation  system  and  indirect  and  other  direct 
cost  system  in  the  incurred  costs  audits;  and  the  control  environment,  accounting  system, 
billing  system,  labor  accounting  system,  and  information  technology  system  in  the 
accounting  system  review. 

In  March  and  April  2012,  DCAA  issued  guidance  revising  its  approach  for  reviewing 
major  contractors’  internal  control  systems.  Significant  changes  included  reducing  from 
10  to  6  the  number  of  internal  control  systems  subject  to  evaluation;  opining  on  the 
contractor’s  compliance  with  the  Defense  Federal  Acquisition  Regulation  Supplement 
regulation  criteria  for  each  system,  and  issuing  a  deficiency  report  when  sufficient 
evidence  is  obtained  to  support  that  a  significant  deficiency  or  material  weakness  exists. 

A  February  24,  2012  Defense  Federal  Acquisition  Regulation  Supplement  rule36 

•57 

implemented  the  following  statutory  requirements: 

•  established  a  “Contractor  Business  System”  clause  defining  contractor  business 
systems  as  the  contractor’s  accounting  system,  estimating  system,  purchasing 


34  Defense  Federal  Acquisition  Regulation  Supplement  Case  No.  2009-D038,  “Business  Systems- 
Definition  and  Administration,”  originally  published  in  the  Federal  Register  on  January  15,  2010,  with  the 
revised  rule  published  on  December  3,  2010. 

35  Previously,  DCAA  opined  on  the  effectiveness  of  the  contractor’s  internal  controls  or  the  adequacy  of  the 
contractor’s  business  systems. 

36  The  Defense  Acquisition  Regulation  Council  previously  issued  an  interim  rule  implementing  the 
statutory  requirements  on  May  1 1,  201 1. 

37  Section  893  of  the  2011  National  Defense  Authorization  Act  established  requirements  for  the 
improvement  of  contractor  business  systems  to  ensure  that  such  systems  provide  timely,  reliable 
information  for  the  management  of  DOD  programs. 
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system,  earned  value  management  system,  material  management  and  accounting 
system,  and  property  management  system; 

•  defined  an  acceptable  business  system  based  on  detailed  criteria  for  each  system; 
and 

•  defined  significant  deficiency. 

Proper  implementation  of  the  revised  approach  to  performing  internal  control  reviews 
could  increase  GAGAS  compliance  on  these  engagements  and  compliance  with  GAGAS 
6.10  and  6.11  on  other  engagements.  We  have  not  reviewed  the  implementation  of  this 
revised  approach;  however,  we  will  monitor  improvement  in  this  area  through  our 
continuous  oversight  of  DCAA. 

Documentation 

Documentation  Needs  Improvement 

In  32  of  the  47  examination  engagements,  the  auditor  did  not  comply  with  GAGAS  and 
DCAA  requirements  for  documentation.  Specifically,  the  auditor  did  not  adequately 
document  the  work  perfonned  to  support  significant  judgments  and  conclusions, 
including  descriptions  of  transactions  and  records  examined.  GAGAS  3.38  requires  that 
auditors  document  significant  decisions  affecting  the  audit  objectives,  scope,  and 
methodology;  findings;  conclusions;  and  recommendations  resulting  from  professional 
judgment.  Furthermore,  GAGAS  6.20  requires  auditors  to  prepare  attest  documentation 
in  connection  with  each  engagement  in  sufficient  detail  to  provide  a  clear  understanding 
of  the  work  perfonned,  including  the  nature,  timing,  extent,  and  results  of  engagement 
procedures  perfonned;  the  evidence  obtained  and  its  source;  and  the  conclusions  reached. 
Inadequate  documentation  hinders  adequate  supervisory  review,  other  management 
reviews,  and  implementation  of  key  quality  control  procedures.  Additional  time  is  also 
required  by  the  audit  staff  and  management  to  correct  identified  deficiencies  thus 
delaying  report  issuance  and  work  on  other  assignments.  It  also  negatively  impacts  other 
future  engagements  when  auditors  inappropriately  rely  on  the  work  performed.  Finally, 
when  engagement  documentation  is  disordered,  hard  to  follow,  or  contains  errors  or 
omissions,  the  work  performed  will  not  stand  on  its  own  when  challenged.  In  the 
extreme,  contracting  officers  or  other  users  do  not  use  the  infonnation  provided  and  stop 
requesting  audit  services.  This  results  in  the  Government’s  interests  not  being  fully 
protected. 

Insufficient  Documentation 

In  24  of  the  47  examination  engagements  reviewed,  the  auditor  did  not  provide  sufficient 
detail  in  the  working  papers.  GAGAS  6.21  requires  auditors  to  prepare  documentation  in 
sufficient  detail  to  enable  an  experienced  auditor,  having  no  previous  connection  with  the 
engagement,  to  understand  from  the  documentation  the  nature,  extent,  and  results  of 
procedures  performed;  the  evidence  obtained  and  its  source;  and  the  auditors’  significant 
judgments  and  conclusions.  Examples  of  documentation  not  providing  sufficient  detail 
included: 
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•  In  a  $12.9  million  cost-type  price  proposal  examination  engagement,  the  auditor 
did  not  sufficiently  document  and  reference  the  work  performed,  including 
evidential  matter  obtained,  to  support  the  cost  questioned.  We  replicated  the 
auditor’s  work  to  verify  the  questioned  cost  calculation.  In  addition,  many 
working  papers  did  not  contain  the  DCAA-required  on-page  notes  needed  to 
explain  the  work  performed.  The  auditor  used  an  Eastern  Region  electronic 
working  paper  program,  Proposal  Evaluation  and  Reporting  System,  to  construct 
spreadsheet  documents  to  support  the  work  performed.  The  spreadsheet  produced 
by  the  program  did  not  contain  referenced  notes  and  did  not  clearly  show  the 
recommended  rates  because  the  rates  were  not  referenced  back  to  source 
documents.  (Assignment  Number  1461-2010D21000003) 

•  During  an  examination  of  a  $  164,295  partial  tennination  of  a  $  1 .3  million  firm- 
fixed-price  contract,  the  auditor  did  not  document  work  perfonned  in  the  detailed 
working  papers  and  the  working  papers  were  very  difficult  to  follow.  Some 
working  papers  did  not  clearly  explain  the  items  tested,  and  others  did  not 
describe  the  supporting  documentation  used  to  accept  the  proposed  costs.  The 
auditor  also  referenced  work  to  e-mail  messages  with  folder  attachments 
containing  the  supporting  documentation;  however,  the  referenced  data  were  not 
readily  identifiable  in  the  e-mail  attachments.  (Assignment  Number  1241- 
2009A17 100003) 

•  In  a  $222.5  million  firm-fixed-price  proposal  examination  engagement,  some 
detailed  working  papers  did  not  have  the  purpose,  source,  scope,  and  conclusion 
sections  required  to  provide  an  explanation  of  the  work  performed.  (Assignment 
Number  280 1-2009G2 1000041) 

•  In  a  $98.8  million  firm-fixed-price  proposal  examination  engagement,  the  auditor 
did  not  properly  document  questioned  labor  costs.  Documentation  of  the  work 
performed  did  not  provide  a  clear  understanding  of  the  calculation  of  $337,747  in 
questioned  labor  costs.  The  reviewer  needed  to  discuss  the  assignment  with  the 
auditor  to  detennine  that  the  calculation  was  acceptable.  (Assignment  Number 
986 1-2009P2 10000 19) 

Inadequate  Documentation  of  Objectives,  Scope,  and 
Methodology 

In  nine  examination  engagements,  the  auditor  did  not  adequately  document  the 
objectives,  scope,  or  methodology.  GAGAS  6.22a  requires  auditors  to  do  so,  including 
descriptions  of  transactions  and  records  examined.  Inadequate  documentation  of 
sampling  plans  is  a  repeat  deficiency  identified  in  our  prior  review  of  the  FY  2006 
DCAA  quality  control  system.  Examples  included: 

•  In  a  $3.7  million  multi-year  incurred  cost  examination  engagement,  the  auditor 
did  not  properly  document  the  nonstatistical  sampling  plans  used  to  perform 
transaction  testing.  The  auditor  did  not  describe  the  universe  from  which  the 
items  were  selected  or  document  how  the  nonstatistical  selections  result  in 
adequate  coverage  of  the  universe  to  meet  the  engagement  objectives.  DCAA 
guidance  requires  this  documentation  in  the  working  papers.  (Assignment 
Number  320 1-2007G10 1000230) 
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•  In  a  $  1 .6  million  incurred  cost  examination  engagement,  the  auditor  did  not 
properly  document  the  nonstatistical  sampling  plans  used  to  perfonn  transaction 
testing.  The  auditor  did  not  quantify  the  proportion  of  the  universe  selected  and 
tested  to  show  adequacy  of  coverage  to  meet  the  objectives  as  required  by  DCAA 
guidance.  (Assignment  Number  2161 -2006P 101 00005) 

Inadequate  Documentation  of  Work  Performed 

In  28  of  the  47  examination  engagements  reviewed,  the  engagement  documentation  did 
not  adequately  support  the  conclusions.  GAGAS  6.22b  requires  auditors  to  document  the 
work  performed  to  support  significant  judgments  and  conclusions.  Examples  of 
inadequate  documentation  included: 

•  In  a  $102.3  million  incurred  cost  examination  engagement,  the  final  report  did  not 
tie  to  the  draft  report  or  summary  working  paper.  The  auditor  explained  that  the 
final  report  was  updated  to  correct  executive  compensation  questioned  costs. 
However,  the  auditor  failed  to  update  the  working  papers  to  provide  the  required 
supporting  documentation  for  the  questioned  cost  in  the  final  report.  (Assignment 
Number  6 1 5 1 -2007N 1 0 1 0000 1 ). 

•  Ina$151.7  million  incurred  cost  examination  engagement,  the  auditor  did  not 
document  a  $29,400  downward  adjustment  of  the  questioned  executive 
compensation  costs.  The  auditor  documented  in  the  working  papers  $223,849  of 
questioned  executive  compensation  costs  based  on  an  analysis  performed  by  the 
Mid-Atlantic  Regional  Compensation  Team,  but  the  final  report  questioned 
$194,449.  The  auditor  stated  the  difference  was  due  to  the  contractor  providing 
further  analysis  of  claimed  executive  compensation;  however,  the  auditor  failed  to 
document  the  analysis  in  the  working  papers.  (Assignment  Number  985 1  - 
2005F10100014) 

Adequate  supervision  and  management  review  of  the  reported  findings  is  not  assured 
when  updated  findings  are  not  properly  documented  in  the  working  papers. 

Fraud,  Illegal  Acts,  Violations  of  Provisions  of  Contracts, 
or  Abuse 

Inadequate  Planning  to  Address  Potential  Fraud  Indicators 

In  3 1  of  the  47  reviewed  examination  engagements,  DCAA  did  not  comply  with  GAGAS 
requirements  to  identify  and  address  potential  fraud  indicators  during  the  planning 
process.  Therefore,  the  audit  offices  did  not  identify  all  potential  areas  of  fraud  or  abuse 
in  the  3 1  engagements.  GAGAS  6.13a  requires  the  auditor  to  design  the  engagement  to 
provide  reasonable  assurance  of  detecting  fraud,  illegal  acts,  or  noncompliance  with  the 
provisions  of  contracts  that  could  have  a  material  effect  on  the  assertion  or  subject  matter 
and  document  the  related  risk  factors.  When  risk  factors  are  identified,  the  auditor  should 
document  the  risk  factor  identified,  the  auditor’s  response  to  the  risk  factor,  and  the 
auditor’s  conclusions.  For  instance: 


45 


•  In  a  defective  pricing  examination  engagement  of  a  $22.7  million  contract,  the 
auditor  documented  that  no  fraud  indicators  were  identified.  However,  the 
auditor  did  not  address  fraud  risk  factors  related  to  compliance  with  the  Truth  in 
Negotiations  Act  and  the  specific  contract  being  reviewed.  In  the  risk  assessment, 
the  auditor  used  a  contractor-provided  estimate  at  completion  worksheet  to 
identify  the  risk  factor  that  profit  at  completion  would  be  significantly  higher  than 
negotiated.  The  auditor  also  noted  that  DCAA  issued  multiple  positive  defective 
pricing  reports  on  the  contractor.  Both  are  fraud  indicators  for  defective  pricing. 
However,  the  auditor  failed  to  design  steps  to  address  the  profit  issue.  At  a 
minimum,  the  auditor  should  have  discussed  the  reason  for  the  increased  profit 
with  the  contractor  and  then  used  that  information  to  design  appropriate  probe 
tests.  In  addition,  because  the  auditor  did  not  specify  the  nature  of  the  previous 
defective  pricing  findings,  they  could  not  detennine  the  significance  of  the  prior 
findings  to  the  current  engagement  or  what  steps  should  be  performed  to  cover 
any  relevant  risk  factors.  (Assignment  Number  6341-2008D42000026) 

•  In  the  risk  assessment  for  a  2007  incurred  cost  examination  engagement  of  a 
contactor  with  approximately  $300  million  in  Government  sales,  the  auditor  noted 
that  a  fraud  referral  was  issued  for  potential  labor  mischarging  during  the  prior 
year’s  engagement  and  the  contractor  was  under  investigation.  However,  contrary 
to  those  facts,  the  auditor  documented  for  the  fraud  risk  assessment  step  that  no 
fraud  risk  indicators  were  disclosed  during  the  preliminary  audit  steps.  The 
auditor  failed  to  document  the  nature  of  the  mischarging,  any  relevant  steps 
needed  for  the  current  engagement,  or  whether  the  already  planned  procedures 
adequately  addressed  the  labor  mischarging  previously  referred  for  investigation. 
(Assignment  Number  6151-2007N10100001) 

•  During  the  examination  engagement  of  a  $  1 .2  million  contract,  the  auditor  did  not 
design  procedures  to  specifically  follow-up  on  significant  prior  findings, 
including  costs  transferred  from  task  orders  with  no  available  funding  to  task 
orders  with  funding.  The  contractor  did  not  have  acceptable  supporting 
documentation,  a  proper  explanation  or  justification,  or  corrected  time  sheets  for 
the  transferred  costs.  The  supervisor  was  also  aware  that  the  audit  office  had 
issued  a  fraud  referral  on  labor  transfers  based  on  a  prior  year’s  incurred  cost 
examination  engagement.  Additional  procedures  to  consider  included  verification 
of  any  cost  adjustment  back  to  source  documents  for  task  orders  with  costs  over 
the  contract  ceiling.  (Assignment  Number  1 66 1-2009H1 7900002) 

•  During  the  perfonnance  of  a  labor  system  examination  engagement  at  a  major 
segment  of  a  top  10  Defense  contractor,  the  auditor  requested  and  received  a 
contractor  internal  audit  report,  but  did  not  follow-up  on  the  issues  and 
recommendations  identified  for  untimely  submittal  of  timecards  and  lack  of  valid 
work  authorizations.  The  contractor  internal  audit  department  categorized  these 
deficiencies  as  important  and  requiring  high  priority  attention  by  management. 
However,  DCAA  did  not  consider  the  significance  of  the  contractor  internal  audit 
results  and  recommendations,  expand  completed  compliance  testing,  or  perform 
additional  procedures  to  adequately  cover  the  issues.  (Assignment  Number  3191- 
2009F13010001) 
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Potential  Fraud  Risks  Not  Reported  as  Required 

In  two  examination  engagements,  the  audit  office  was  aware  of  potential  fraud,  illegal 
acts,  or  abuse  but  did  not  report  it  to  outside  parties.  The  appropriate  authorities  did  not 
have  the  opportunity  to  determine  whether  to  pursue  the  potential  fraud  criminally, 
civilly,  or  administratively.  GAGAS  6.40  provides  that  the  auditor  should  comply  with 
legal  requirements  to  report  known  or  likely  fraud,  illegal  acts,  violations  of  contract 
provisions,  or  abuse  to  outside  entities.  DCAA  is  required  to  report  such  instances  to  the 
appropriate  Government  investigative  organization.  The  two  engagements  identified 
were: 

•  During  an  incurred  cost  examination  engagement  that  identified  $3.8  million  in 
questioned  indirect  expenses,  the  auditor  failed  to  submit  a  fraud  referral  for  the 
contractor  repeatedly  claiming  expressly  unallowable  costs  despite  documented 
guidance  from  the  detachment  audit  manager  that  a  fraud  referral  should  seriously 
be  considered.  (Assignment  Number  9851-2005F10100014) 

•  In  a  pre-award  accounting  system  examination  engagement  of  a  small  contractor, 
the  auditor  obtained  sufficient  evidence  indicating  the  contractor  was  charging 
and  billing  excessive  hours  for  employees,  and  was  improperly  billing 
consultants  as  employees.  However,  the  auditor  did  not  identify  these  issues  as 
fraud  indicators  and  refer  the  potential  fraud.  (Assignment  Number  6431- 
2009B 177400 13) 

Current  DCAA  Guidance  Should  Be  Revised  to  Increase 
Coverage  of  Fraud  Indicators 

Current  DCAA  guidance  is  not  sufficient  to  ensure  that  examination  engagements 
comply  with  requirements  related  to  detection,  identification,  and  reporting  of  potential 
fraud,  illegal  acts,  or  abuse.  Insufficient  planning,  risk  assessment,  and  design  of  tests 
related  to  fraud,  illegal  acts,  violations  of  contract  provisions,  and  abuse  is  a  repeat 
deficiency  identified  in  our  May  2007  report  on  the  FY  2006  DCAA  quality  control 
system.  DCAA  nonconcured  with  our  previous  recommendation  that  it  enforce  its 
guidance  requiring  audit  offices  to  discuss  potential  fraud  risks  during  the  annual 
planning  discussion  with  contractor  representatives.  Instead,  DCAA  determined  that  the 
AICPA  requirement  that  it  based  its  guidance  on  only  applied  to  financial  statement 
audits  and,  therefore,  DCAA  eliminated  the  requirement. 

From  August  2011  through  June  2012,  DCAA  incorporated  a  revised  fraud  risk 
assessment  procedure  in  its  standard  audit  programs  for  examination  engagements.  The 
brainstonning  procedure  requires  the  audit  team  (managers,  supervisors,  and  auditors)  to 
discuss  the  risk  of  fraud  for  that  engagement  and  to  discuss  the  risk  of  fraud  throughout 
the  engagement.  It  also  involves  designing  procedures  to  address  the  identified  fraud 
risks  to  provide  reasonable  assurance  of  detecting  fraud  and  other  noncompliances  with 
applicable  laws  and  regulations  that  could  have  a  material  effect  on  the  contractor’s 
assertion.  However,  at  the  time  DCAA  revised  its  standard  programs,  DCAA  did  not 
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issue  the  standard  DCAA  guidance  document  explaining  the  new  process  nor  has 
DCAA  included  guidance  on  this  process  in  its  CAM.  The  guidance  in  CAM  should 
explain  the  reason  for  performing  the  step  and  tie  it  to  the  applicable  GAGAS  and 
AICPA  requirements.  Additionally,  since  DCAA  updated  its  computerized  training 
course  on  Fraud  Awareness  in  August  201 1,  it  should  reassess  the  course’s  coverage  to 
detennine  whether  revisions  are  needed  to  cover  the  team  brainstonning  process. 

DCAA  also  does  not  require  its  audit  staff  to  perform  a  step  that  many  organizations  find 
useful.  As  mentioned  above,  on  July  16,  2007,  DCAA  eliminated  the  requirement  for  its 
auditors  to  make  inquiries  of  contractor  management  of  management’s  knowledge  of 
fraud  risks  during  its  annual  planning  meeting  with  major  contractors.  Under  commonly 
followed  guidance,  issued  in  1992  and  updated  in  1994,  by  the  Committee  on  Sponsoring 

TO 

Organizations  ,  a  key  component  of  a  company’s  internal  control  framework  is  a  risk 
assessment  process  to  identify  and  analyze  the  internal  and  external  risks  to  achieving  its 
business  objectives,  including  compliance  with  applicable  laws  and  regulations.  Also 
many  Government  contracts40  issued  after  December  12,  2008  contain  Federal 
Acquisition  Regulation  52.203- 1 3 (c)(2)(ii)(C)  clause  requiring  the  contractor  to 
periodically  evaluate  and  assess  the  risk  of  criminal  conduct  and  modify  its  internal 
controls  and  compliance  programs  as  necessary  to  address  that  risk.  Thus  a  responsible 
contractor  should  already  be  assessing  the  risks  of  fraud,  illegal  acts,  and  noncompliances 
with  applicable  laws  impacting  Government  contracts  and  be  prepared  to  discuss  the 
identified  risks  with  DCAA.  Such  discussions  would  be  beneficial  both  on  an  annual 
basis  and  on  specific  engagements  during  the  entrance  conference.  These  discussions 
with  management  regarding  fraud  risk  are  already  a  requirement  for  financial  statement 
auditors  under  AICPA  AU  316  which  is  incorporated  by  reference  into  the  GAGAS  2011 
version41  for  financial  audits.  For  attestation  engagements,  the  GAGAS  2011  version 
does  not  directly  incorporate  the  AICPA  requirements.  The  management  inquiry 
procedure  represents  a  best  practice  that  DCAA  should  incorporate  in  its  standard  fraud 
risk  assessment  process  and  instruct  its  audit  staff  to  begin  holding  such  discussions  with 
contractor  representatives  immediately. 

Revised  Finding  and  Recommendation 

As  a  result  of  management  comments,  we  revised  the  draft  finding  on  the  GAGAS  2011 
version  requirement  to  discuss  fraud  risks  with  contactor  management  to  clarify  the 


38  DCAA  normally  issues  an  MRD  to  its  audit  offices  explaining  changes  to  its  guidance  and  processes  or 
procedures,  or  providing  relevant  information  related  to  its  audit  work. 

39  The  Committee  on  Sponsoring  Organizations  [COSO]  was  formed  in  1985  to  issue  guidance  on  how 
companies  could  implement  the  Treadway  Commission’s  recommendations  designed  to  reduce  the 
probability  of  fraud  in  financial  reporting.  The  issued  guidance  defined  internal  control  and  five 
interrelated  components  of  internal  control  which  included  control  environment;  risk  assessment;  control 
activities;  information  and  communication;  and  monitoring. 

40  The  contracting  officer  is  to  use  this  clause  in  Government  contracts  and  subcontracts  that  are  for  more 
than  $5  million  and  have  period  of  performance  lasting  120  days  or  longer.  Contracts  for  the  acquisition  of 
commercial  items  or  that  will  be  performed  outside  of  the  U.S.  are  exempt. 

41  The  2011  version  of  GAGAS  is  effective  for  financial  audits  and  attestation  engagements  for  periods 
ending  on  or  after  December  15,  2011. 
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requirement  when  performing  attestation  engagements.  We  also  revised 
Recommendation  1 1  .a  to  clarify  the  nature  of  the  additional  resources  needed  to  assist 
auditors  with  their  assessment  of  fraud  indicators  and  determination  of  audit  steps  to 
address  the  indicators. 

Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

11.  Increase  the  effectiveness  of  and  compliance  with  fraud-related  standards 
by: 


a.  Developing  a  toolkit  or  guidance  for  auditors  to  use  when  assessing  fraud 
risk  indicators  to  determine  which  procedures  or  steps  to  include  to 
address  each  fraud  indicator  identified  during  planning.  It  should  also 
provide  information  on  determining  which  steps  to  expand,  include 
alternative  steps  to  perform  when  more  appropriate  than  expanding 
existing  steps,  and  address  any  fraud  indicator  found  during  the 
execution  phase  of  the  engagement. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  in  June  2012,  DCAA  revised  all  applicable 
audit  programs  to  include  audit  team  discussions  on  fraud  risk  and  other  noncompliances 
that  could  have  a  material  effect  on  the  audit  and  the  design  of  appropriate  audit 
procedures.  Stating  that  the  current  DCAA  teaming  approach  that  encourages  critical 
thinking  is  a  better  approach,  DCAA  did  not  agree  with  providing  auditors  a  “toolkit”  of 
audit  steps  for  each  fraud  indicator  because  it  could  lead  to  a  “checklist  mentality.” 
However,  DCAA  will  assess  the  need  for  the  enhancement  of  audit  procedures  related  to 
fraud  risk  during  an  ongoing  policy  project  on  fraud  by  June  30,  2013. 

Our  Response 

DCAA  comments  did  not  fully  address  the  intent  of  the  recommendation.  We  agree  that 
the  recently  implemented  audit  team  discussions  on  fraud  risk  are  a  positive  step  to  a 
more  comprehensive  fraud  risk  assessment  process.  This  approach  will  not  be  fully 
effective  without  the  proper  resources  to  support  the  process.  Thus,  the  intent  of  the 
recommended  toolkit  is  to  support  and  promote  critical  thinking  by  providing  information 
to  the  auditor  on  the  relationship  between  potential  fraud  indicators  and  audit  procedures. 
The  audit  team  would  use  this  information  during  team  discussions  to  ensure  that 
indicators  are  properly  addressed  in  both  the  planning  and  execution  phases.  DCAA 
should  consider  issuing  guidance  that  provides  examples  on  additional  audit  steps  to  be 
performed  to  address  specific  fraud  indicators.  We  request  that  DCAA  to  provide 
additional  comments  on  this  recommendation  in  response  to  the  final  report. 
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b.  Revising  guidance  to  include  a  revised  fraud  risk  assessment  procedure  in 
which  the  audit  team  (managers,  supervisors,  and  auditors)  discusses  the 
risk  of  fraud  for  that  engagement  and  design  procedures  to  address  the 
identified  fraud  risks  as  required  by  government  auditing  standards. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  it  revised  all  applicable  audit  programs  in 
June  2012  to  require  audit  team  discussions  on  fraud  risk  and  to  design  audit  procedures 
to  address  the  identified  risks.  DCAA  concluded  that  based  on  the  team  discussions  and 
the  other  risk  assessment  procedures,  the  audit  team  designs  audit  procedures  to  address 
identified  fraud  indicators.  DCAA  considers  the  actions  taken  to  address  this 
recommendation  complete. 

Our  Response 

The  DCAA  comments  were  partially  responsive  to  the  intent  of  the  recommendation. 
DCAA  has  revised  all  applicable  audit  programs  to  include  audit  team  discussions  on 
fraud  risk.  No  guidance  exists  to  explain  the  team  discussion  process  or  illustrate  it.  The 
audit  team  discussion  approach  differs  decidedly  from  the  prior  fraud  risk  assessment 
step.  Therefore,  the  audit  team  needs  appropriate  guidance  to  ensure  its  effective 
implementation.  DCAA  normally  issues  guidance  documents  when  making  process 
improvement  changes.  We  request  that  DCAA  reconsider  issuing  relevant  guidance  to 
support  its  revised  fraud  risk  assessment  process  and  provide  comments  on  the  final 
report. 


c.  Revising  guidance  and  all  applicable  standard  audit  programs  to  require 
the  audit  staff  to  ask  pertinent  questions  of  appropriate  level  contractor 
personnel  regarding  the  contractor’s  assessment  of  fraud  risks  relating  to 
the  assertion  or  subject  matter  of  the  engagement. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  the  American  Institute  of  Certified  Public 
Accountants  AT  601.33,  which  is  incorporated  into  GAGAS  for  attestation  engagements, 
does  not  include  the  requirement  to  inquire  of  company  management  about  its  assessment 
of  fraud  risk.  However,  DCAA  will  consider  including  this  requirement  and  others  on 
fraud  as  referenced  in  the  AICPA  auditing  standards  but  not  required  by  the  AICPA 
attestation  standards  in  its  policy  project  on  fraud  and  assess  whether  enhancements  to 
fraud  risk  guidance  are  needed  by  June  30,  2013. 

Our  Response 

The  management  comments  were  partially  responsive  to  the  intent  of  the 
recommendation.  Asking  contractor  management  about  its  assessments  of  the  risk  of 
fraud  in  its  business  operations  impacting  government  contracts  represents  a  best 
practice.  We  agree  that  inquiring  of  management  about  its  fraud  risk  assessments  is  not  a 
GAGAS  requirement  for  attestation  engagements.  Performing  management  inquiries, 
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however,  will  enhance  the  effectiveness  of  designing  the  audit  to  detect  instances  of  fraud 
material  to  the  engagement,  which  is  a  GAGAS  requirement.  Certified  Public 
Accountants  are  required  by  auditing  standards  to  make  management  inquiries  about 
fraud  risk  in  perfonning  audits  to  protect  stockholder  interests.  DCAA  should 
incorporate  the  same  requirement  when  perfonning  contract  audits  of  Defense  contractors 
to  protect  taxpayer  interests.  We  revised  this  report  section  to  clarify  the  GAGAS 
reference  to  AICPA  auditing  and  attestation  standards’  requirements.  We  request  that 
DCAA  strongly  consider  adding  this  requirement  to  its  fraud  risk  assessment  process  as 
they  complete  the  fraud  policy  project.  DCAA  should  provide  comments  on  the  final 
report. 


d.  Assessing  the  August  2011  version  of  the  Fraud  Awareness  training 
course  to  determine  whether  it  covers  all  DCAA  required  processes 
associated  with  identification,  detection,  and  reporting  of  potential  fraud 
and  revise  the  course,  as  needed,  to  provide  such  coverage. 

DCAA  Comments 

DCAA  agreed  stating  that  DCAA  would  assess  its  Fraud  Awareness  training  course  and 
revise  it,  as  needed,  for  any  changes  in  guidance  by  December  3 1,  2013. 

Our  Response 

DCAA  comments  were  responsive.  The  Fraud  Awareness  training  course  is  DCAA’s 
primary  training  vehicle  on  fraud  and  auditor  responsibilities  regarding  fraud  when 
perfonning  audits.  If  possible,  DCAA  should  complete  this  action  by 
June  30,  2013.  No  additional  comments  are  required. 

Supervision 

Ineffective  Supervision 

For  38  of  the  47  examination  engagements  reviewed,  supervision  was  ineffective  to 
ensure  that  work  perfonned  met  standards.  GAGAS  6.04a  states  that  the  supervisor  must 
properly  supervise  any  assistants  [auditors].  Supervision  involves  reviewing  the  work 
perfonned  to  ensure  that  it  was  adequately  performed  and  supports  the  report 
conclusions.  Supervisors  should  also  review  the  work  perfonned  to  verify  that  it 
complies  with  GAGAS.  For  most  engagements  reviewed,  the  supervisor  documented 
initial,  interim,  and  final  reviews  as  required  by  DCAA  procedures.  However  the  pattern 
of  multiple  noncompliances  with  planning,  communication,  evidence,  documentation, 
and  fraud-related  standards  clearly  indicates  that  supervision  was  inadequate.  Inadequate 
or  ineffective  initial,  interim,  and  final  supervision  directly  led  to  the  significant  number, 
74  percent,  of  assignments  reviewed  that  demonstrated  a  lack  of  professional  judgment. 

We  also  identified  10  of  47  reviewed  examination  engagements  with  deficiencies  in 
supervisory  documentation.  The  DCAA  electronic  audit  assignment  software  generates 
standard  documents  for  the  supervisor  to  document  approval  of  planned  steps,  initial 
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guidance,  interim  review,  and  final  reviews.  Examples  of  documentation  deficiencies 
included: 

•  In  six  examination  engagements,  final  supervisory  review  comments  were  either 
not  made  or  the  comments  were  generally  administrative  in  nature  and  did  not 
provide  guidance  to  correct  GAGAS-related  deficiencies.  (Assignment  Numbers 
643 1-2009B 177400 13;  2641-2009C1 101001;  3191-2009F13010001;  3521- 
2009C2 1000011;  6381-2009G1 1590001;  and  1461-2010D21000003) 

•  In  two  examination  engagements,  the  supervisory  auditor  either  did  not  provide 
adequate  initial  guidance  prior  to  the  auditor  completing  the  risk  assessment  or 
did  not  provide  interim  review  comments.  (Assignment  Numbers  4901- 
2008W17900010  and  4261-2009T27000040) 

•  In  one  examination  engagement,  the  supervisor  did  not  approve  the  initial  audit 
plan.  (Assignment  Number  615 1-2007N10 100001) 

•  In  one  examination  engagement,  the  supervisor  did  not  approve  the  sample  plan 
prior  to  its  implementation.  (Assignment  Number  9731 -2007B 101 000 1 7) 

Six  of  the  above  examples  of  deficiencies  in  supervisory  documentation  were  identified 
on  engagements  where  DCAA  did  not  demonstrate  professional  judgment.  The 
supervisory  documentation  deficiencies  we  identified  combined  with  supervisors’  failures 
to  identify  significant  deficiencies  in  the  work  they  were  responsible  for  reviewing 
indicate  that  DCAA  supervisors  could  be  filling  in  the  required  standard  forms  in  a 
perfunctory  manner.  DCAA  should  consider  whether  changes  to  the  standard 
supervisory  administrative  documents  would  help  improve  the  effectiveness  of 
supervisory  reviews,  especially  for  newly  promoted  supervisors. 

Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

12.  Improve  the  effectiveness  of  supervisory  auditors  and  compliance  with 
government  auditing  standards  by: 

a.  Revising  existing  standard  electronic  working  papers  that  supervisory 
auditors  use  to  document  supervisory  guidance  and  review  to  address 
specific  government  auditing  standards  and  Defense  Contract  Audit 
Agency  guidance  requirements; 

b.  Providing  additional  tools  such  as  a  link  to  suggested  potential  corrective 
actions  to  remedy  any  identified  deficiencies,  and  reminder  checklists 
directly  linked  to  the  electronic  working  paper  packages  for  supervisory 
auditors  to  use  as  aids  when  reviewing  assignments. 
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c.  Moving  the  audit  guidance  on  performing  and  documenting  supervisory 
reviews  from  the  Defense  Contract  Audit  Agency  Contract  Audit  Manual 
to  a  location  or  source  directly  linked  to  the  electronic  working  paper 
packages  so  that  the  information  is  more  readily  available  to  users. 

DCAA  Comments 

DCAA  agreed  in  principle  with  the  recommendations.  DCAA  stated  that  it  has  taken 
steps  to  improve  the  effectiveness  of  supervisory  auditors  in  complying  with  GAGAS 
through  training  and  other  initiatives  that  help  supervisors  understand  their 
responsibilities  under  the  standards  and  DCAA  policy.  DCAA  also  stated  that  it  required 
all  supervisory  auditors  to  attend  a  training  course  that  addressed  supervisory 
responsibilities  in  FY  2011.  Additionally,  the  DCAA  Integrity  and  Quality  Assurance 
Directorate  provided  the  Supervisory  Auditor  Assignment  Review  Process  Workshop  to 
give  all  supervisors  training  on  reviewing  working  papers.  DCAA  also  initiated  a 
coaching  program  to  assist  supervisors  in  performing  their  duties.  DCAA  disagreed  with 
providing  supervisory  auditors  with  suggestions  and  reminders  because  it  could  lead  to  a 
“checklist  mentality”  and  inhibit  the  critical  thinking  skills  needed  to  determine  the 
appropriate  corrective  actions  for  specific  circumstances.  DCAA  considers  the  actions 
related  to  the  intent  of  these  recommendations  complete. 

Our  Response 

DCAA  comments  were  generally  responsive.  No  additional  comments  are  required.  As 
part  of  our  followup  and  monitoring  responsibilities,  we  will  consider  whether  the 
training  and  other  initiatives  are  sufficient  to  maintain  and  continue  to  improve 
supervisory  skills. 

Reporting 

DCAA  Reports  Did  Not  Comply  with  GAGAS  Requirements 

In  34  of  the  47  examination  engagements,  the  report  did  not  comply  with  GAGAS 
reporting  standards.  Generally,  the  reports  did  not  comply  with  GAGAS  because  the 
evidence  obtained  was  not  sufficient  to  support  the  report  conclusions.  GAGAS  6.04b 
states  that  auditors  must  obtain  sufficient  evidence  to  provide  a  reasonable  basis  for  the 
conclusion  that  is  expressed  in  the  report.  Some  reports  also  should  not  have  been  issued 
because  the  report  did  not  include  appropriate  qualifications,  and  the  report  conclusions 
were  not  consistent  with  the  draft  report  and  supporting  working  papers.  A  summary  of 
significant  deficiencies  identified  are  detailed  in  Table  6  below. 


Table  6.  Summary  of  Identified  Reporting  Noncompliances 
with  GAGAS  and  DCAA  Policies 


Cite 

Requirements 

Summary  of  Finding 

GAGAS  1.12b 

Auditors  should  include  a  modified 
GAGAS  compliance  statement  in 
reports  on  GAGAS  attestation 
engagements,  as  appropriate  if  the 

In  one  examination  engagement,  a  review 
of  direct  costs  claimed  on  flexibly  priced 
contracts,  the  auditor  did  not  include  the 
required  “GAGAS  Peer  Review 

53 


AT42 


Cite 


101.74 


_ Requirements _ 

auditor  was  unable  to  and  did  not 
perform  the  attestation  engagement 
in  accordance  with  GAGAS. 


The  auditor’s  decision  to  provide  a 
qualified  opinion,  to  disclaim  an 
opinion,  or  to  withdraw  because  of 
a  scope  limitation  in  an  examination 
engagement  depends  on  an 
assessment  of  the  effect  of  the 
omitted  procedure(s)  on  his  or  her 
ability  to  express  assurance.  The 
reasons  for  a  qualification  or 
disclaimer  should  be  described  in 
the  auditor’s  report. 


_ Summary  of  Finding _ 

Qualification  Statement”  in  the 
February  9,  2010  report.  The  DCAA 
Director  issued  a  memorandum  to  all 
DCAA  employees  instructing  them  to 
include  a  modified  GAGAS  statement  in 
the  scope  paragraph  for  all  reports  issued 
on  or  after  August  27,  2009  because  the 
DOD  Inspector  General  opinion  on  the 
DCAA  quality  control  program  expired  as 
of  that  date.  (Assignment  No.  9731- 

2007B10100017) _ 

In  three  examination  engagements 
discussed  below,  DCAA  did  not  properly 
address  scope  limitations  or  the  needed 
report  qualification.  Failure  to  provide  all 
relevant  information  in  the  report 
negatively  impacts  the  contracting 
officer’s  ability  to  appropriately  negotiate 
or  administer  the  contract(s). 


Qualified 
Opinion: 
CAM43  10- 
210. 4. d 


Access  to 
Records: 

CAM  1-504.4.C 
and  .d 


The  Qualification  paragraph  should 
include  circumstances  that  result  in 
a  qualified  opinion.  A  qualification 
would  arise  from  contractor 
deficiencies  such  as  a  lack  of  access 
to  or  inadequate  contractor  records. 

The  following  conditions  qualify  as 
an  access  to  records  problem: 
restrictions  on  reproduction  of 
necessary  supporting  evidential 
matter,  and  partial  or  complete 
denial  of  access  to  internal  audit 
data  or  other  management  reports 
on  contractor  operations. 


In  a  FY  2008  Control  Environment 
examination  engagement,  DCAA  did 
not  include  the  appropriate  report 
qualification  for  an  access  to  records 
issue.  The  contractor  provided  the  85 
contractor  hotline  cases  that  DCAA 
requested;  however,  80  of  the  85 
cases  provided  had  the  infonnation 
redacted.  The  extensive  redactions 
eliminated  critical  infonnation 
required  by  the  auditor.  This  created 
an  access  to  records  issue  in 
accordance  with  DCAA  guidance 
that  the  auditor  should  have 
recognized  as  such  and  qualified  the 
report  accordingly.  (Assignment  No. 
331 1-2008C1 1070001) 


42  The  AICPA  uses  the  designation  of  “AT”  to  reference  the  various  attestation  standards.  The  attestation 
standards  referenced  in  this  table  are  ones  which  GAGAS  incorporates  by  reference. 

43DCAA  provides  guidance  to  its  auditors  in  its  CAM.  CAM  references  indicate  what  specific  guidance 
DC  AA  has  issued  to  implement  the  corresponding  GAGAS  or  attestation  standards. 
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Cite 


Requirements 


Floor  Checks: 
CAM  10- 
504. 3.b 


If  labor  floor  checks  or  interviews 
were  considered  necessary  to 
complete  the  audit  [engagement] 
but  could  not  be  accomplished 
concurrently  for  the  period  audited, 
insert  the  following  additional 
statement  in  the  scope  paragraph: 
“The  concurrent  verification  of 
(indicate  whether  labor,  materials  or 
both)  was  omitted  in  this 
examination  (if  accomplished  in  at 
least  one  year  of  a  multi-year 
examination,  state  fiscal  years 
omitted).” 


Assist  Audits: 
CAM  10- 
504. 3.b  (see 
citation  above) 
and 

CAM  10-504.4 


The  report  should  be  qualified  if  the 
incurred  cost  audit  included 
requests  for  assist  audits  on 
subcontract  costs  that  were  not 
received  in  time  for  incorporation  in 
the  final  report.  The  procedure 
provides  specific  information  that 
the  report  should  include  such  as 
subcontract  number,  subcontractor 
name,  claimed/billed  amount  for  the 
subcontract,  name  of  the  audit 


Summary  of  Finding 


In  a  FY  2006  incurred  cost 
examination  engagement  that  included 
$500,456  in  claimed  total  labor  costs, 
the  auditor  did  not  qualify  the  report 
for  lack  of  a  labor  floor  check  as 
required  by  DCAA  guidance.  The 
auditor  also  did  not  document  the 
performance  of  additional  steps  as 
required  by  DCAA  guidance  when 
there  is  an  omission  of  labor  in  the 
examination.  In  addition,  the  audit 
office  failed  to  assess  and  describe  in 
the  report  the  impact  of  the  omitted 
verification  of  labor  costs  on  the 
engagement  results.  (Assignment  No. 
04 17 1-2006G10 100007). 

In  a  FY  2006  incurred  cost 
examination  engagement  that 
included  $50,221,659  in  claimed 
labor  costs,  the  auditor  did  not 
qualify  the  report  for  nonperformance 
of  a  labor  floor  check  or  non-receipt 
of  a  requested  assist  audit  as  required 
by  DCAA  guidance.  The  auditor 
documented  during  the  planning 
phase  that  the  report  would  be 
qualified  due  to  the  inability  to 
detennine  the  impact  of  the  lack  of 
perfonnance  of  a  labor  floor  check. 
(Assignment  No.  3171- 
2006J1 01 00002) 

In  the  same  examination  engagement, 
the  audit  office  also  did  not  qualify 
the  report  for  non-receipt  of  a 
requested  assist  subcontract  audit. 
Finally,  the  auditor  did  not  qualify 
the  report  for  two  cost  accounting 
standards’  noncompliances  that 
related  to  several  million  dollars  of 
independent  research  and 
development  costs  that  were 
identified  during  the  engagement. 
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Cite 

Requirements 

Summary  of  Finding 

office  performing  the  assist,  and  the 
expected  due  date  for  the  assist 
audit  report. 

(Assignment  No.  3171- 
2006J1 01 00002) 

GAGAS  6.34 

Auditors  should  report  significant 
deficiencies  in  internal  control,  or 
combination  of  deficiencies,  that 
adversely  affects  the  entity’s  ability 
to  initiate,  authorize,  record, 
process,  or  report  data  reliably  in 
accordance  with  the  applicable 
criteria  or  framework  such  that 
there  is  more  than  a  remote 
likelihood  that  a  misstatement  of 
the  subject  matter  that  is  more  than 
inconsequential  will  not  be 
prevented  or  detected. 

In  a  budget  and  planning  system 
examination  engagement,  the  auditor  did 
not  identify  a  system  deficiency  regarding 
the  lack  of  written  policies  and 
procedures.  Without  this  infonnation  the 
contracting  officer  cannot  take  the 
appropriate  action  to  have  the  contractor 
remedy  the  deficiency.  A  delay  of  this 
type  also  causes  the  Government  to 
unnecessarily  increase  the  amount  of 
oversight  needed  of  the  contractor. 
(Assignment  No.  4301-2009H1 1020002) 

GAGAS  6.42 

In  presenting  findings  such  as 
deficiencies  in  internal  control, 
auditors  should  develop  the 
elements  of  the  findings  to  the 
extent  necessary  to  achieve  the 
objectives.  GAGAS  6.15  through 
6.19  describe  clearly  developed 
findings  and  include  criteria, 
condition,  cause,  and  effect  or 
potential  effect. 

In  a  budget  and  planning  system 
examination  engagement,  the  auditor  did 
not  write  the  report  using  the  proper 
fonnat  of  condition,  cause,  effect,  and 
recommendation.  Contracting  officers 
require  all  relevant  information  to  achieve 
an  acceptable  resolution  to  the  identified 
deficiencies  and  protect  the  Government’s 
interests.  (Assignment  No.  4301- 
2009H 11020002) 

GAGAS  6.49 

Auditors  should  evaluate  the 
validity  of  the  audited  entity’s 
comments  when  the  contractor’s 
comments  are  inconsistent  or  in 
conflict  with  the  report’s  findings, 
conclusions,  or  recommendations, 
or  when  planned  corrective  actions 
do  not  adequately  address  the 
auditors’  recommendations.  If  the 
auditors  disagree  with  the 
comments,  they  should  explain  in 
the  report  their  reasons  for 
disagreement. 

In  an  indirect  and  other  direct  costs 
internal  control  system  examination 
engagement,  the  contractor  verbally 
disagreed  with  the  findings.  The  auditor 
did  not  include  the  disagreement  or 
address  it  in  the  final  report.  Failure  to 
rebut  all  the  contractor’s  arguments  in  the 
report  could  delay  resolution  or  correction 
of  the  system  deficiencies.  It  allows  the 
contractor  to  argue  the  points  directly 
with  the  contracting  officer  without  the 
DCAA  rebuttal  being  directly  available. 

The  contracting  officer  could  decide  the 
issues  without  contacting  DCAA, 
assuming  that  DCAA  has  no  rebuttal 
arguments  since  they  are  not  reflected  in 
the  report.  (Assignment  No.  1721- 
2009B14980001) 
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GAGAS  6.56a 

Auditors  should  distribute  copies  of 
the  reports  to  other  officials 
responsible  for  acting  on 
engagement  findings  and 
recommendations,  and  to  others 
authorized  to  receive  such  reports. 

In  two  examination  engagements,  the 
report  distribution  section  did  not  properly 
list  all  required  recipients.  The 
distribution  list  should  act  as  an  official 
record  of  who  received  the  report. 

•  In  a  price  proposal  examination 
engagement  for  $417,610,  the 
auditor  did  not  list  the  DCAA 
headquarters  financial  liaison 
advisor  in  the  report  distribution 
section.  DCAA  policy  states  that 
financial  liaison  advisors  are  to 
receive  forward  pricing  audit  reports 
issued  to  the  component  they 
service.  The  report  is  to  be 
distributed  to  the  DCAA 
headquarters  financial  liaison 
auditor  to  facilitate  the  advisor 
answering  contracting  officer 
questions  regarding  the  report 
contents.  This  is  done  so  that 
negotiations  can  proceed 
expeditiously.  (Assignment  No. 
6701-2010S27000002) 

•  In  an  incurred  cost  examination 
engagement  at  a  contractor  with 
$149  million  in  revenue,  the  auditor 
did  not  list  the  applicable  non-DoD 
agencies  in  the  report  distribution 
section  even  though  the  audit  office 
specified  the  use  of  the  non-DoD 
regulation  supplements  as  criteria  in 
the  scope  of  audit  section  of  the 
report.  Therefore,  either  the 
appropriate  non-DoD  agencies  did 
not  receive  the  report  or  the  audit 
office  incorrectly  used  non-DoD 
regulations  as  criteria  when 
perfonning  and  reporting  on  the 
engagement.  (Assignment  No. 

3171  -2006 J 101 00002) 

DCAA  should  assess  its  guidance  on  including  qualifications  in  its  reports  for  compliance 
with  GAGAS.  The  current  guidance,  as  referenced  in  the  cases  above,  does  not  provide 
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guidance  on  when  and  how  to  add  a  modified  GAGAS  compliance  statement  in  the 
report.  GAGAS  1.12b  specifies  “...Situations  when  auditors  use  modified  compliance 
statements  include  scope  limitations,  such  as  restrictions  on  access  to  records, 
government  officials  or  other  individuals  needed  to  conduct  the  audit.”  GAGAS  1.12b 
also  requires  certain  information  be  included  in  the  report  when  using  a  modified 
GAGAS  statement  which  includes: 

•  the  applicable  requirements  not  followed; 

•  the  reasons  for  not  following  the  requirements;  and 

•  how  not  following  the  requirements  affected,  or  could  have  affected,  the 
engagement  and  the  assurance  provided. 

DCAA  should  also  review  the  implementation  of  its  guidance  to  determine  whether 
auditors  are  identifying  all  applicable  situations  that  require  report  qualifications, 
especially  those  related  to  access  to  records  issues.  Auditors  should  still  qualify  reports 
for  access  to  records  issues  even  when  court  decisions  limit  DCAA’s  legal  right  to  have 
certain  documents.  For  instance,  DCAA  interprets  two  1988  Fourth  Circuit  Court  of 
Appeals  decisions44  as  holding  that  language  in  the  statutes  giving  DCAA  access  to 
contractor’s  books  and  records  did  not  generally  include  internal  audit  reports  unrelated 
to  a  specific  contract  or  proposal.  However,  in  certain  engagements  such  as  the  Overall 
Control  Environment  and  Accounting  System  review  or  a  labor  audit,  contractor  internal 
audit  reports  and  the  associated  working  papers  contain  vital  infonnation.  Therefore, 
when  the  audit  office  detennines  that  information  is  needed  to  comply  with  GAGAS, 
then  the  report  should  be  qualified  accordingly  and  the  qualification  properly  explained. 
The  key  issue  is  whether  the  auditor  determined  that  the  infonnation,  records,  or  data 
obtained  through  interviews  was  needed  to  fonn  their  opinion. 

Written  Reports  Not  Distributed  in  a  Timely  Manner 

In  20  examination  engagements,  DCAA  did  not  issue  the  report  in  a  timely  manner. 

CAM  10-103.1  requires  that  reports  to  be  issued  on  or  before  the  dates  specified  and,  in 
any  event,  as  promptly  as  possible.  DCAA  guidance  also  provides  that  when  a  specified 
reporting  date  does  not  allow  sufficient  time  to  perform  a  complete  audit,  the  auditor 
should  request  a  time  extension.  When  the  extension  is  granted,  it  should  be  confirmed 
in  writing.  To  be  useful,  the  report  must  be  timely.  Delays  in  issuing  certain  reports  such 
as  system  reviews  and  operations  audits  also  result  in  use  of  additional  auditor  time, 
sometimes  further  delaying  the  report  issuance.  The  auditor  has  to  perform  additional 
work  to  update  findings  which  would  not  have  been  required  if  the  report  was  issued 
promptly.  Untimely  reports  or  the  failure  to  properly  coordinate  report  due  date 
extensions  also  negatively  impact  the  contract  negotiation  or  administration  timeline. 
Examples  included: 

•  An  accounting  system  report  with  an  inadequate  system  opinion  was  issued 


44  United  States  v  Newport  News  Shipbuilding  and  Diy  Dock  Company,  837  F.2d  162  (4th  Cir.  1988)  and 
United  States  v  Newport  News  Shipbuilding  and  Diy  Dock  Company,  862  F.2d  464  (4th  Cir.  1988). 
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19  months  after  the  entrance  conference  was  held.  The  significant  reporting  delay 
allowed  the  accounting  system  status  to  remain  adequate  based  on  the  previous 
2006  engagement.  In  addition,  the  delay  impeded  the  contracting  officer  from 
taking  action  to  affect  timely  correction  of  the  deficiencies.  (Assignment 
Number  331 1-2008C1 1070001) 

•  For  an  incurred  cost  examination  engagement,  the  contracting  officer  was  notified 
of  the  start  date  of  the  engagement,  but  not  infonned  of  significant  delays.  The 
report  was  issued  3  years  later.  This  delayed  the  resolution  of  $3.8  million  in 
questioned  overhead  costs,  a  decrease  of  2.9  percent  in  the  overhead  rate. 
(Assignment  Number  9851-2005F10100014) 

•  A  report  on  proposed  FY  2009  forward  pricing  rates  was  issued  3  months  after  the 
end  of  FY  2009  and  about  10  months  from  the  requested  date.  Thus  DCAA’s 
recommendations  for  questioned  indirect  rates  could  not  be  implemented  in 
related  2009  contracting  actions.  (Assignment  Number  418 1-2009A23000002) 

•  In  some  examination  engagements,  when  the  DCAA  auditor  requested  an 
extension  of  a  due  date,  the  report  was  still  issued  7-10  days  after  the  extended 
due  date  with  no  explanation  or  follow-up  notification  in  the  working  paper  file. 
The  delays  potentially  impacted  the  contracting  officer’s  negotiation  plans  or 
schedules  or  made  the  reports  irrelevant  when  the  contracting  officer  decides  to 
proceed  without  the  report. 

Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

13.  Revise  existing  guidance  on  reporting  scope  limitations  or  qualifications  to 
comply  with  generally  accepted  government  auditing  standards  paragraph 
1.12b  and  American  Institute  of  Certified  Public  Accountants  AT  101.74 
requirements. 

DCAA  Comments 

DCAA  agreed  in  principle  stating  that  the  DOD  IG  findings  were  not  exceptions  to 
guidance,  rather  implementation  issues.  DCAA  stated  that  scope  limitations  and 
appropriately  qualifying  reports  were  addressed  during  the  Training  Initiative  on 
Perfonning  Quality  Audits  discussed  in  response  to  Recommendation  2.  DCAA 
considers  the  actions  taken  to  address  the  intent  of  the  recommendation  to  be  complete. 

Our  Response 

DCAA  comments  did  not  address  the  intent  of  the  recommendation.  We  agree  that 
providing  training  on  reporting  scope  limitations  or  qualifications  should  improve 
compliance  with  the  standards;  however,  DCAA  did  not  address  whether  its  existing 
guidance  complies  with  GAGAS  1.12b  and  AICPA  AT  101.74.  We  request  that  DCAA 
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provide  comments  on  the  final  report  specifying  the  action  it  will  take  to  ensure  its 
guidance  is  compliant. 

14.  Revise  existing  training  to  emphasize  to  the  audit  staff  the  importance  of 
including  the  effect  of  any  access  to  records  issue  on  the  engagement  in  the 
applicable  report. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  the  Defense  Contract  Audit  Institute 
Course  6115,  Effective  Report  Writing,  that  is  required  for  all  auditors  in  their  second 
year  with  DCAA,  includes  a  handout  of  DCAA  Instruction  7640. 17,  “Formal  Reporting 
Procedures  for  Denial  of  Access  to  Contractor’s  Records.”  The  topic  also  was  covered 
under  the  Training  Initiative  on  Perfonning  Quality  Audits  discussed  in  response  to 
Recommendation  2.  DCAA  considers  the  actions  to  address  this  recommendation 
complete. 

Our  Response 

DCAA  comments  were  responsive.  No  additional  comments  are  required. 

15.  Issue  a  memorandum  to  the  audit  staff  re-emphasizing  the  importance  of 
including  the  effect  of  any  access  to  records  issue  on  the  engagement  in  the 
applicable  report. 

DCAA  Comments 

DCAA  agreed  in  principle.  DCAA  stated  that  all  DCAA  audit  staff  received  training  on 
scope  limitations  and  denial  of  access  to  records  during  the  Training  Initiative  on 
Perfonning  Quality  Audits  provided  from  December  2010  and  April  2011.  DCAA 
considers  the  actions  taken  to  address  the  intent  of  this  recommendation  complete. 

Our  Response 

DCAA  comments  were  responsive.  No  additional  comments  are  required. 

Agreed-Upon  Procedures  Engagements 

Inadequate  Planning  and  Performance 

DCAA  did  not  exercise  professional  judgment  in  planning  and  perfonning  the  two 
agreed-upon  procedures  engagements  we  reviewed,  Assignment  Numbers  4141- 
2009B28000001  and  4601-2010S28000001.  The  difference  between  performing  an 
agreed-upon  procedures  engagement  and  other  attestation  engagements  is  that  the 
requester  takes  responsibility  for  defining  the  procedures  to  be  perfonned  during  the 
engagement.  AT  Section  201.03  defines  an  agreed-upon  procedures  engagement  as  one 
in  which  the  auditor  is  engaged  by  a  client  to  issue  a  report  of  findings  based  on  specific 
procedures  performed  on  the  subject  matter.  The  auditor  assists  the  specified  parties  in 
evaluating  the  subject  matter  or  an  assertion  based  on  the  specified  parties’  needs. 
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Therefore,  obtaining  all  specified  parties’  (requester  and  users)  agreement  with  the 
specific  procedures  to  be  performed  and  properly  defining  the  agreed-upon  procedures  to 
be  perfonned  are  key  factors  to  complying  with  GAGAS  and  the  AICPA  standards.  In 
the  two  reviewed  engagements,  DCAA  met  neither  requirement.  Because  the  two 
reviewed  agreed-upon  procedures  engagements  were  planned  and  performed  as  assist 
audits45  for  other  DCAA  offices,  DCAA  failed  to  obtain  this  agreement  with  the  original 
requesters.  The  agreed-to  procedures  that  DCAA  auditors  performed  also  were  not 
adequately  defined  or  did  not  otherwise  meet  AICPA  requirements.  This  is  a  repeat 
finding  from  a  report  previously  issued  on  May  1,  2007.  Our  review  also  identified  other 
deficiencies  in  auditor  communication  during  planning  and  obtaining  evidence.  Based  on 
the  deficiencies  identified,  neither  report  should  have  been  issued. 


DCAA  Assist  Audits  Performed  Without  Obtaining  Ail  Users’ 
Agreement 

DCAA  planned  and  perfonned  both  reviewed  agreed-upon  procedures  engagements  as 
assist  audits  for  another  DCAA  audit  office.  AT  201.03  defines  specified  parties  to 
include  the  requester  who  has  engaged  the  auditor  to  assist  the  specified  parties  in 
evaluating  an  assertion  or  subject  matter  based  on  the  identified  specified  parties  needs. 
Additionally,  AT  601. 1646  explains  that  the  objective  of  an  agreed-upon  procedures 
engagement  is  to  present  specific  findings  to  assist  users  in  evaluating  an  entity’s 
compliance  with  specified  requirements.  In  both  engagements,  the  original  requester  was 
also  a  specified  party  to  the  assist  audit  since  the  original  requester  was  the  end  user  of 
the  work  perfonned  under  the  assist  audit.  AT  20 1 .07  and  AT  60 1 . 1 8  state  that  the 
auditor  should  ordinarily  communicate  directly  with  all  specified  parties  or  users  to 
obtain  an  affinnative  acknowledgement  on  the  procedures  to  be  performed  from  each  of 
them.  AT  201.11  emphasizes  that  the  requester  and  other  users,  the  specified  parties,  are 
responsible  for  the  sufficiency  of  the  agreed-to  procedures  because  they  best  understand 
their  own  needs.  In  neither  engagement  did  the  audit  office  performing  the  assist  audit 
obtain  agreement  on  the  procedures  to  be  performed  from  the  original  requester.  The 
DCAA  audit  office  that  requested  the  assist  audit  also  did  not  obtain  the  original 
requester’s  agreement  on  the  procedures.  Because  the  requester  and  other  users  assume 
the  risk  that  the  procedures  might  be  insufficient  for  their  purposes,  it  is  especially 
important  that  the  end  user  understand  and  agree  to  the  procedures  to  be  performed. 
According  to  AT  201.07  and  AT  601.18,  the  auditor  should  not  report  on  an  engagement 


45  Assist  audits  refer  to  the  situation  where  one  DCAA  auditor  at  one  location  is  furnished  assistance  in  the 
form  of  a  GAGAS-compliant  engagement  or  audit  by  a  DCAA  auditor  at  another  location.  DCAA  audit 
offices  perform  work  at  contractor  locations  within  a  defined  geographic  location  and  a  prime  contractor 
may  include  costs  not  supported  by  the  books  and  records  maintained  at  its  geographic  location.  DCAA 
audit  offices  generally  perform  assist  audits  on  subcontracts,  offsite  labor,  or  on  costs  which  are  allocated 
from  or  to  records  which  are  maintained  at  home  offices,  other  divisions,  segments,  cost  centers,  etc.  The 
DCAA  audit  office  cognizant  of  the  prime  contractor  is  responsible  for  identifying  the  elements  of  cost 
requiring  assist  audits  and  requesting  the  assist  audits. 

46  DCAA  generally  follows  AT  Section  601,  Compliance  Attestation,  when  performing  its  attestation 
engagements.  AT  601  provides  requirements  in  addition  to  the  general  requirements  specified  in  AT 
Sections  20,  50,  101,  and  201. 
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when  specified  parties  or  specified  users  do  not  agree  on  the  procedures  to  be  performed 
and  do  not  take  responsibility  for  the  sufficiency  of  the  procedures  for  their  purposes. 
DCAA  should  not  have  performed  the  two  assist  audits  as  agreed-upon  procedures 
engagements  using  the  existing  DCAA  guidance. 

Noncompliance  with  Requirements  to  Define  Procedures 

The  procedures  that  DCAA  agreed  to  perform  in  both  engagements  did  not  comply  with 
the  AICPA  definition  or  criteria  for  acceptable  procedures  for  this  engagement  type. 

AT  201.15  and  AT  601.17  recognize  that  the  procedures  that  the  auditor  and  specified 
parties  or  users  agree  to  may  be  as  limited  or  as  extensive  as  the  specified  parties  desire. 
However,  the  standards  require  that  certain  criteria  be  met.  Table  7  below  summarizes 
the  various  deficiencies  our  review  identified  in  the  two  reviewed  engagements  relating 
to  the  relevant  standards.  The  identified  deficiencies  are  similar  to  noncompliances 
reported  on  in  our  May  1,  2007  report  discussed  below. 


Table  7.  Deficiencies  in  Defining  the  Procedures  to  Be  Performed 


Assignment  Number 

Deficiency  Identified 

4141 -2009B2800000 1 

4601-2010S28000001 

Neither  of  the  two  agreed-upon  procedures  performed  in  this 

engagement  complied  with  the  standards’  requirements. 

•  Procedure  1  did  not  define  ‘available’  which  was  used  as  criteria  in 
the  agreed-to  procedure.  AT  201.16  provides  that  the  auditor  should 
not  agree  to  perfonn  overly  subjective  procedures  that  are  possibly 
open  to  varying  interpretations.  Tenns  of  uncertain  meaning  should 
not  be  used  in  describing  the  procedures  unless  the  terms  are  defined 
within  the  procedure.  Procedure  1  did  not  comply  with  this 
requirement. 

•  Procedure  1  also  did  not  include  a  time  period.  AT  201.15  requires 
that  the  nature,  timing,  and  extent  of  the  procedures  be  agreed  to. 

The  time  period  to  be  covered  by  the  procedure  is  critical  to  the 
finding’s  usefulness  to  the  requester  and  other  users. 

•  Procedure  2  only  required  the  auditor  to  provide  the  requester  with 
specific  backup  documents.  AT  201.15  provides  that  a  procedure 
cannot  be  just  the  reading  of  an  assertion  or  specified  information 
about  the  subject  matter  because  perfonning  this  type  of  procedure 
does  not  produce  results  for  the  auditor  to  report  on.  Therefore, 
providing  backup  documentation  is  also  not  an  acceptable  procedure 
because  this  task  also  does  not  result  in  a  finding  for  the  auditor  to 
report  on. 

The  procedure  performed  in  this  engagement  did  not  meet  the  standards 

for  two  reasons. 

•  The  criteria  used  to  perform  the  procedure  were  not  properly  defined 
as  required  by  AT  201.16  discussed  above. 

•  The  auditor  did  not  apply  the  agreed-upon  procedures  on  the  third 
quarter  data  submitted  with  the  request,  but  instead  used  the  fourth 
quarter  forecast  data  the  audit  office  obtained  from  the  contractor 
component  responsible  for  generating  the  data.  Therefore,  the 
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Assignment  Number 

Deficiency  Identified 

auditor  did  not  have  a  formal  agreement  with  all  the  users  as  to  the 
time  period  to  be  covered  by  the  agreed-to  procedure  as  required  by 
AT  201.15  discussed  above.  Because  the  assist  audit  covered  fourth 
quarter  data  instead  of  third  quarter  data,  its  results  did  not  cover  the 
same  time  period  as  the  audit  of  the  prime  contractor.  This 
increased  the  end  user’s  risk  of  misunderstanding  or  inappropriately 
using  the  information  provided. 

DCAA  should  ensure  that  the  correct  definition  of  the  agreed  to  procedures  is  applied  by 
its  audit  staff  when  perfonning  agreed-upon  procedures  engagements  to  prevent 
misinterpretation  or  inappropriate  use  of  the  findings  by  users. 

Other  Noncompliances  Impacted  the  Usefulness  of  the  Work 
Performed 

Our  review  identified  other  significant  noncompliances  in  the  two  reviewed  engagements 
that  increased  the  users’  risk  that  they  might  misunderstand  or  otherwise  inappropriately 
use  the  findings  reported  by  the  audit  offices.  Table  8  below  summarizes  the  identified 
deficiencies. 


Table  8.  Other  Noncompliances  Identified  in  Reviewed  Agreed-Upon  Procedures 
_ _ Engagements _ 


Assignment  Number 

Noncompliance  Identified 

4141 -2009B2800000 1 

•  The  engagement  did  not  comply  with  GAGAS  6.06  requirement 

to  obtain  written  acknowledgement  or  other  evidence  of  the  entity’s 
responsibilities  for  the  subject  matter  or  the  written  assertion  as  it 
relates  to  the  objectives  of  the  engagement.  The  DCAA  assist  audit 
request  references  a  prime  contractor’s  claim  that  the  subcontractor 
costs  met  the  Federal  Acquisition  Regulation  exception  for 
commerciality  and  attached  a  copy  of  a  subcontractor  invoice  to 
identify  the  pertinent  part.  The  auditor  did  not  obtain  the  required 
written  acknowledgement  or  other  evidence  of  the  subcontractor’s 
responsibility  for  the  written  assertion  as  it  relates  to  the  engagement 
objectives.  The  prime  contractor  cannot  take  responsibility  for  a 
subcontractor’s  claim  that  a  specific  item  complies  with  the 
regulatory  exception  for  commerciality47  because  the  commerciality 

47  Federal  Acquisition  Regulation  Subpart  2.101  defined  a  “commercial  item”  as  any  item,  other  than  real 
property,  that  is  of  a  type  customarily  used  for  nongovernmental  purposes  and  that:  (i)  has  been  sold, 
leased,  or  licensed  to  the  general  public;  (ii)  has  been  offered  for  sale,  lease,  or  license  to  the  general 
public;  (iii)  has  evolved  from  a  commercial  item  that  is  sold  or  offered  for  sale  as  a  result  of  technological 
advancement;  (iv)  requires  either  modification  of  a  type  that  is  customarily  available  in  the  commercial 
market  place  or  minor  modifications  for  unique  Government  purposes;  or  (v)  any  combination  of  the  above 
items. 
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Assignment  Number 

Noncompliance  Identified 

4141 -2009B2800000 1 
and 

4601-2010S28000001 

exception  is  based  on  sales  data  that  the  prime  contractor  either 
does  not  have  access  to  or  control  of.  Proper  identification  of  the 
assertion  to  be  reviewed  by  the  requester  or  the  entity  responsible  for 
the  assertion  is  required  to  ensure  that  the  end  user  obtains  the 
correct  infonnation. 

•  The  engagement  also  did  not  comply  with  the  GAGAS  6.04b 
requirement  to  obtain  sufficient  evidence  to  support  the  report. 
Additionally,  the  engagement  did  not  comply  with  AT  201.16 
requirements  to  obtain  evidential  matter  from  applying  the  agreed- 
upon  procedure  to  provide  a  reasonable  basis  for  the  finding(s) 
expressed  in  the  report.  The  auditor  did  not  verify  or  obtain 
sufficient  evidence  that  the  end  users  were  not  state,  local,  or  Federal 
Government,  or  companies  acting  on  behalf  of  the  Government. 

Using  these  criteria  is  a  key  factor  in  determining  whether  an  item 
qualifies  for  a  commerciality  exemption  for  submittal  of  certified 
cost  or  pricing  data.  The  request  specifically  clarified  the  criteria  to 
be  used  by  including  that  definition  for  general  public.  Therefore, 
the  contracting  officer  relied  on  inaccurate  information  during 
negotiations. 

•  Neither  engagement  complied  with  the  GAGAS  6.07  requirements 
to  communicate,  in  writing,  the  auditor’s  understanding  of  the 
services  to  be  perfonned  to  the  appropriate  officials  of  the  entity’s 
management.  Our  review  also  identified  this  noncompliance  in  all 
of  the  examination  engagements  we  reviewed.  Additional 
infonnation  on  this  noncompliance  is  provided  in  the  ‘Auditor 
Communication  During  Planning’  section  of  this  report. 

Inadequate  Implementation  ofDCAA  Training  on  Agreed-Upon 
Procedures 

The  audit  staff  who  worked  on  both  engagements  did  not  take  CMTL  (Computer 
Managed  Training  Library)  No.  1249,  Agreed-Upon  Procedures,  prior  to  performing  the 
agreed-upon  procedures  engagement.  This  training  is  required  by  MRD  08-PSP-030, 
“Audit  Guidance  on  Agreed-Upon  Procedures  (AUP)  Engagements,”  dated 
September  24,  2008.  DCAA  headquarters  established  this  requirement  after  issuance  of 
DOD  IG  Report  Number  D-2007-6-006  dated  May  1,  2007,  that  identified  similar 
deficiencies  as  those  described.  The  identified  deficiencies  included: 

•  Failure  to  comply  with  key  GAGAS  or  AICPA  attestation  standards  as 
incorporated  in  GAGAS. 


48  Per  Federal  Acquisition  Regulation  Subpart  15.403-l(b),  a  contracting  officer  shall  not  require  certified 
cost  or  pricing  data  to  support  a  pricing  action  when  a  commercial  item  is  being  acquired. 
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•  No  evidence  that  the  requester  agreed  to  or  accepted  responsibility  for  the 
procedures  perfonned. 

•  Criteria  were  not  appropriately  defined.  Procedures  were  not  appropriately 
defined. 

•  All  reporting  requirements  were  not  met. 

In  response  to  the  report  findings  and  recommendations,  DCAA  also  revised  its  guidance 
on  performing  agreed-upon  procedures  engagements  and  planned  to  continue  monitoring 
this  type  of  engagement  until  DCAA  management  was  satisfied  that  compliance  with 
GAGAS  had  improved.  Prior  to  the  establishment  of  the  September  24,  2008  training 
requirement  and  while  field  work  was  ongoing,  DCAA  issued  a  November  9,  2006, 
memorandum  that  transmitted  headquarters-provided  training  materials  to  assist  regional 
and  Field  Detachment  office  staff  to  monitor  agreed-upon  procedures  engagements.  The 
training  was  to  be  completed  by  January  31,  2007. 

Despite  these  initiatives,  for  the  two  reviewed  agreed-upon  procedures  engagements,  the 
audit  offices  did  not  comply  with  GAGAS  3.45  requirements  that  auditors  should  be 
knowledgeable  of  and  be  competent  in  applying  the  AICPA  general  attestation  standard 
related  to  criteria,  the  AICPA  attestation  standards  for  field  work  and  reporting,  and  the 
related  Statements  on  Standards  for  Attestation  Engagements.  The  audit  staff  did  not 
collectively  possess  sufficient  knowledge  to  perform  the  engagement.  The  lack  of 
knowledge  or  training  contributed  to  the  audit  offices  not  perfonning  the  agreed-upon 
procedures  engagements  correctly. 

DCAA  Guidance  on  Agreed-Upon  Procedures  Needs  Further 
Improvement 

The  DCAA  CAM  and  the  applicable  standard  audit  programs  do  not  provide  adequate 
guidance  on  performing  an  agreed-upon  procedures  engagement  as  an  assist  audit.  CAM 
14- 100 1(b)  explains  that  under  GAGAS,  DCAA  may  perfonn  an  agreed-upon  procedures 
engagement  for  any  assignment  if:  (1)  the  subject  matter  or  assertion  to  which  the 
procedures  are  to  be  applied  is  subject  to  reasonably  consistent  measurement;  (2)  the 
requester  and  DCAA  agree  on  the  nature,  timing  and  extent  of  the  procedures  to  be 
applied,  including  the  criteria  to  be  used;  and  (3)  the  requester  assumes  responsibility  for 
the  sufficiency  of  the  procedures.  However,  the  DCAA  guidance  does  not  cover  the 
additional  steps  required  when  an  assist  audit  is  requested  or  perfonned.  Therefore,  the 
DCAA  guidance  does  not  address  the  additional  AICPA  requirements  in  AT  201.15  and 
AT  601.18  that  require  [all]  specified  parties  or  users  to  agree  to  the  procedures. 

Revised  Finding  and  Recommendation 

We  have  added  additional  AICPA  attestation  standard  references  to  the  finding  and 
Recommendation  16  to  further  clarify  the  requirements. 
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Recommendations,  Management  Comments,  and  Our 
Response 

Recommendations 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

16.  Revise  existing  guidance  on  performing  agreed-upon  procedures 
engagements  as  assist  audits  to  fully  comply  with  the  American  Institute  of 
Certified  Public  Accountants  AT  201.15  and  AT  601.18  requirements. 

DCAA  Comments 

DCAA  did  not  agree  stating  that  the  contracting  officer  was  not  a  specified  party  to  the 
assist  agreed-upon  procedures  engagements  reviewed  by  the  DOD  IG.  DCAA  also  stated 
that  the  requesting  audit  office  determined  the  procedures  to  be  performed  as  part  of  its 
audit  assignment  and  accepted  responsibility  for  those  procedures.  Therefore,  the 
contracting  officer  was  not  a  specified  party  to  the  agreed-upon  procedures  and  the  audit 
office  was  not  required  to  obtain  the  contracting  officer’s  agreement  on  the  procedures 
perfonned  by  the  assist  audit  office. 

Our  Response 

DCAA  comments  were  nonresponsive.  We  consider  the  contracting  officer  a  specified 
party  within  the  context  of  AT  201.03  and  other  referenced  attestation  standards  included 
in  the  body  of  this  finding.  DCAA’s  main  function  is  to  perfonn  contract  audits  for  use 
by  DoD  procurement  and  contract  administration  offices.  As  such,  another  DoD 
component  is  generally  the  end  user  of  DCAA  reports.  DCAA  issued  the  reports  under 
the  reviewed  assignments  for  contracting  officer  use  during  negotiations  of  contracts  with 
contractors.  We  request  that  DCAA  reconsider  its  position,  and  provide  comments  on  the 
final  report. 

17.  Provide  training  on  performing  generic  agreed-upon  procedures 
engagements  to  all  DCAA  auditors  using  training  from  an  outside  source 
such  as  the  American  Institute  of  Certified  Public  Accountants. 

DCAA  Comments 

DCAA  did  not  agree  stating  that  providing  agreed-upon  procedures  training  to  the  audit 
staff  would  not  be  a  responsible  use  of  resources  because  the  percentage  of  agreed-upon 
procedures  assignments  that  DCAA  perfonns  is  very  low  (approximately  1.3  percent  in 
FY  2012). 

Our  Response 

DCAA  comments  were  not  responsive  to  the  intent  of  the  recommendation.  DCAA 
assignments  have  consistently  not  complied  with  all  attestation  standards  when 
perfonning  agreed-upon  procedures  engagements.  Any  DCAA  auditor  could  be  assigned 
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this  type  of  assignment.  For  perfonning  attestation  engagements,  GAGAS  requires 
auditors  to  be  knowledgeable  of  the  applicable  AICPA  standards  and  guidance  and  be 
competent  in  applying  the  standards  and  guidance  to  the  task  assigned.  Therefore,  all 
DCAA  auditors  need  training  on  performing  agreed-upon  procedures  engagements.  This 
training  can  be  part  of  a  more  comprehensive  training  class.  DCAA  should  reconsider  its 
position  on  this  recommendation  and  provide  comments  on  the  final  report. 

Performance  Audit 

Operations  audits49  are  the  only  type  of  assignment  that  DCAA  conducts  as  a 
perfonnance  audit50  which  is  covered  by  GAGAS  Chapters  6  and  7.  The  operations  audit 
reviewed,  Assignment  Number  224 1-2009B 1050 1001,  is  1  of  the  37  assignments  that 
demonstrated  a  lack  of  professional  judgment.  We  based  our  detennination  on  the 
deficiencies  identified  in  multiple  standards  which  included  planning,  communications, 
evidence,  documentation,  supervision,  and  reporting.  The  end  result  was  an  ineffective 
audit  that  took  9  months  to  complete  and  provided  cost  avoidance  recommendations 
related  to  a  contract  task  order  that  expired  within  weeks  of  report  issuance.  The  waste  of 
more  than  1,100  audit  hours,  valued  at  about  $1 18,700,  is  of  particular  concern  since  the 
audit  office  in  Afghanistan,  which  has  limited  resources  to  conduct  high-risk,  critical 
audits,  performed  the  audit. 

Deficient  Planning  Negatively  Impacted  Completion  of 
Assignment 

DCAA  set  up  the  operations  audit  we  reviewed  to  evaluate  the  contractor’s  effectiveness 
in  supporting  operations  under  a  logistics  contract  in  Afghanistan.  However,  the  audit 
office  did  not  adequately  plan  the  audit  to  address  the  objectives  as  required  by 
GAGAS  7.06.  We  identified  numerous  deficiencies  in  the  audit  planning  which  resulted 
in  a  perfonnance  audit  without  a  definitive  audit  objective  or  plan. 

•  The  risk  assessment  did  not  comply  with  GAGAS  7.11a  and  7.13  requirements. 
The  risk  assessment  did  not  consider  all  the  relevant  contract  and  task  order 
information  nor  did  it  adequately  document  a  sufficient  understanding  of  contract 
requirements  necessary  to  plan  the  audit.  The  auditor  did  not  consider  the  impact 
of  contractor  operations  on  the  logistics  contract  in  Afghanistan  ending  within  the 
year.  Neither  did  the  auditor  consider  the  relevancy  of  the  processes  selected  for 
review  to  the  contractor’s  other  operations  in  Southwest  Asia  or  to  future  task 


49  An  operations  audit  is  performed  to  inquire  into  contractor  management  and  operational  decisions  that 
affect  the  nature  and  level  of  costs  being  proposed  and  charged  to  Government  contracts.  The  auditor  uses 
the  knowledge  gained  from  the  audit  as  the  basis  for  constructive  recommendations  to  the  contractor  to 
improve  its  internal  control  structure  and  the  economy  and  efficiency  of  its  operations. 

50  GAGAS  1.25  defines  performance  audits  as  “..  .engagements  that  provide  assurance  or  conclusions  based 
on  an  evaluation  of  sufficient,  appropriate  evidence  against  stated  criteria,  such  as  specific  requirements, 
measures,  or  defined  business  practices.  Performance  audits  provide  objective  analysis  so  that  management 
and  those  charged  with  governance  and  oversight  can  use  the  information  to  improve  program  performance 
and  operations,  reduce  costs,  facilitate  decision  making  by  parties  with  responsibility  to  oversee  or  initiate 
corrective  actions,  and  contribute  to  public  accountability.” 
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orders  on  the  follow-on  logistics  contract,  if  won.  GAGAS  requires  auditors  to 
assess  audit  risk  and  significance  by  obtaining  an  understanding  of  the  nature  of 
the  program  being  audited  and  the  potential  use  of  the  report. 

•  The  auditor  did  not  identify  the  sources  of  audit  evidence,  and  the  amount  and 
type  of  evidence  needed,  given  the  audit  risk  and  significance  as  required  by 
GAGAS  7.12.  The  auditor  listed  general  areas  to  probe  in  the  risk  assessment 
conclusion  and  did  not  identify  the  criteria  and  source  documents  to  be  used  to 
perfonn  the  probe  testing.  This  level  of  specificity  was  essential  for  the  auditor  to 
make  a  reasonable  assessment  from  the  probe  testing  on  whether  the  contractor 
could  achieve  a  significant  cost  avoidance  in  the  reviewed  area.  Using  this 
assessment  the  auditor  would  further  detennine  whether  a  more  detailed  review  of 
that  area  should  be  performed.  In  addition,  the  auditor  did  not  perfonn  any  probe 
testing  procedures  for  several  of  the  areas  listed  in  the  risk  assessment  and  did  not 
document  the  basis  for  the  decision  not  to  perform  any. 

•  The  auditor  did  not  adequately  document  the  critical  ‘go  or  no  go’  decision.  The 
related  working  paper  did  not  explain  the  basis  for  the  determination  that  certain 
areas  were  a  ‘go,’  e.g.  labor  management,  and  certain  were  a  ‘no  go,’  e.g.  build¬ 
up  and  draw  down  operations  and  subcontract  processes.  GAGAS  7.50  requires 
auditors  to  prepare  a  written  plan  that  contains  key  decisions  about  the  audit 
objectives,  scope  and  methodology;  and  the  auditor’s  basis  for  those  decisions. 

•  The  working  papers  did  not  have  a  detailed  audit  plan  to  review  the  labor 
management  area  determined  to  be  a  ‘go’  for  evaluation.  GAGAS  7.50  provides 
that  the  auditor  should  update  the  plan,  as  needed,  to  reflect  any  significant 
changes  to  the  plan  made  during  the  audit.  The  decision  to  evaluate  the  labor 
management  process  required  the  auditor  to  formulate  procedures  to  address  the 
audit  objectives  for  reviewing  this  process. 

•  The  supervisory  auditor  did  not  properly  supervise  the  audit  planning  as 
evidenced  by  the  numerous  deficiencies  we  identified.  GAGAS  7.51  requires 
audit  organization  management  to  supervise  audit  planning  and  determine 
whether  the  audit  plan  adequately  addresses  relevant  risks,  the  proposed  scope 
and  methodology  are  adequate  to  address  the  audit  objectives,  and  available 
evidence  is  likely  to  be  sufficient  and  appropriate  for  the  purposes  of  the  audit. 

The  numerous  audit  planning  deficiencies  led  to  a  poorly  executed  audit. 

Inadequate  Documentation  and  Insufficient  Evidence 

The  auditor  did  not  adequately  document  the  work  performed  in  this  audit  and  did  not 
provide  sufficient  evidence  to  support  the  report  conclusions  and  recommendations.  A 
supporting  working  paper  was  missing  and  others  were  not  referenced  back  to  audit  steps, 
causing  the  assignment  to  be  difficult  to  follow.  GAGAS  7.77  requires  auditors  to 
prepare  audit  documentation  in  sufficient  detail  to  enable  an  experienced  auditor,  having 
no  previous  connection  to  the  audit,  to  understand  from  the  audit  documentation  the 
nature,  timing,  extent,  and  results  of  procedures  performed,  the  audit  evidence  obtained, 
and  its  source  and  the  conclusions  reached.  The  poor  quality  of  audit  documentation  also 
contributed  to  deficiencies  identified  with  the  sufficiency  of  the  evidence.  The  auditor 
did  not  provide  sufficient  evidence  to  support  the  revised  recommended  cost  avoidance 
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amount.  GAGAS  7.55  states  that  auditors  must  obtain  sufficient,  appropriate  evidence  to 
provide  a  reasonable  basis  for  their  findings  and  conclusions.  The  original  auditor 
identified  seven  findings  on  labor  management  and  staffing  in  Afghanistan  and  calculated 
a  cost  avoidance  of  over  $32  million,  which  was  included  in  the  draft  report.  Several 
months  later,  another  auditor  detennined  that  only  one  of  the  original  conditions  was 
valid  based  on  the  contractor’s  response  to  the  draft  report.  The  second  auditor 
recalculated  the  cost  avoidance  of  $564,000  based  on  the  expiring  task  order.  However, 
the  documented  audit  evidence  does  not  support  this  audit  conclusion.  We  were  unable 
to  determine  from  the  inadequate  and  incomplete  documentation  what  procedures  were 
perfonned  or  additional  evidence  was  obtained  for  the  auditor  to  negate  most  of  the 
original  findings  and  significantly  reduce  the  recommended  cost  avoidance  amount. 

Ineffective  Supervision 

Supervision  of  this  audit  was  ineffective  and  failed  to  correct  the  significant  deficiencies 
identified  in  audit  planning,  execution,  and  reporting.  GAGAS  7.53  requires  that  audit 
supervisors  properly  supervise  audit  staff.  The  audit  working  papers  contained  some 
documented  supervisory  and  management  reviews  of  the  audit;  however,  neither  the 
supervisor  nor  audit  manager  signed  off  on  the  revised  working  papers,  including  the 
revised  audit  summary  working  paper  that  detennined  the  original  conditions  and  cost 
avoidance  amount  were  not  valid.  GAGAS  7.80c  provides  that  supervisory  review  of  the 
work  performed  supporting  findings,  conclusions,  and  recommendations  in  the  audit 
report  should  be  documented  prior  to  report  issuance.  The  lack  of  documented  supervisor 
or  management  review  of  these  key  working  papers  directly  contributed  to  the 
deficiencies  identified  in  the  report  as  discussed  in  the  next  paragraph. 

Deficiencies  in  Reporting 

The  final  audit  report  contained  several  significant  flaws.  As  previously  discussed,  the 
report  was  not  timely  or  useful  since  the  contractor’s  operations  were  ending  in 
Afghanistan  and  the  task  order  on  which  the  cost  avoidance  was  calculated  was  to  expire 
shortly  after  the  report  issuance.  The  report  also  did  not  explain  how  the 
recommendations  to  improve  the  efficiency  of  the  labor  management  process  would 
positively  impact  the  contractor’s  other  operations  in  Southwest  Asia.  Additionally,  the 
final  report  was  confusing  and  difficult  to  understand.  It  listed  all  seven  original  findings 
from  the  draft  report  even  though  the  audit  office  detennined  that  only  one  finding  should 
be  reported  after  considering  the  contractor’s  response  to  the  draft  report.  GAGAS  8.36 
requires  the  auditor  to  modify  the  report  when  the  auditor  decides  that  the  contractor’s 
comments  disagreeing  with  audit  findings  are  valid.  Therefore,  the  auditor  should  have 
included  only  the  one  finding  in  the  final  report.  Also,  while  the  contractor  agreed  with 
the  one  reported  finding,  the  auditor  did  not  obtain  the  contractor’s  position  on  the 
methodology  used  to  calculate  the  cost  avoidance.  GAGAS  emphasizes  the  importance 
of  obtaining  auditee  comments  to  the  development  of  a  fair,  complete,  and  objective 
report.  GAGAS  also  permits  the  use  of  oral  comments  in  certain  circumstances.  If  the 
contractor  disagrees  with  the  recommended  cost  avoidance,  the  contracting  officer’s 
overall  detennination  on  the  report  recommendations  is  more  difficult  or  time  consuming 
without  the  auditor’s  rebuttal  comments  readily  available.  Finally,  the  audit  office  and 
regional  technical  specialists  debated  whether  the  report  should  be  issued.  The  report,  as 
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written,  should  not  have  been  issued.  It  should  either  be  supplemented  to  make  it 
applicable  to  current  or  future  contractor  operations  or  rescinded  as  recommended  in 
Recommendation  1  of  this  report. 
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Appendix  A.  Scope  and  Methodology 


We  conducted  this  review  from  January  2010  through  July  2012  in  accordance  with  the 
Quality  Standards  for  Inspection  and  Evaluation  issued  by  the  CIGIE.51 

We  accomplished  our  review  of  each  report  and  its  working  papers  using  a  standard 
checklist  adapted  from  the  checklist s)  in  the  CIGIE  “Guide  for  Conducting  External  Peer 
Reviews  of  the  Audit  Organizations  of  Federal  Offices  of  Inspector  General,” 

March  2009.  We  used  the  2007  version  of  GAGAS  issued  by  the  Comptroller  General  of 
the  United  States,  GAO-07-73 1G,  to  review  the  selected  assignments.  In  perfonning  our 
review,  we  assessed,  reviewed,  and  evaluated: 

•  the  independence  documentation  to  verify  compliance  with  GAGAS  requirements 
and  the  measures  that  enable  the  identification  of  independence  impairments; 

•  records  of  continuing  professional  education  to  verify  compliance  with  GAGAS 
requirements;  and 

•  50  assignments  and  related  project  documentation  to  detennine  whether 
applicable  standards  and  established  policies  and  procedures  were  followed. 

We  selected  the  assignments  to  review  using  the  DCAA  Management  Infonnation 
System  Analysis  of  the  World  reports  for  the  first  and  second  quarters  of  FY  2010.  We 
detennined  how  many  of  each  type  of  engagements  to  review  based  on  the  number  of 
those  types  of  engagements  DCAA  completed  in  each  quarter.  In  selecting  the  individual 
assignments  to  review,  we  obtained: 

•  a  representative  selection  from  all  five  regions  and  the  Field  Detachment;  and 

•  a  representative  range  of  assignments  performed  by  the  subcategory.  For 
instance,  incurred  cost  audit  engagements  selected  included  engagements 
perfonned  at  both  large  and  small  contractors. 

Table  A  briefly  summarizes  our  assignment  selection  by  region  and  Field  Detachment 
and  types  of  assignments. 


51  The  Inspector  General  Reform  Act  of  2008,  Public  Law  110-409,  created  the  CIGIE  by  combining  what 
were  formerly  known  as  the  President’s  Council  on  Integrity  and  Efficiency  and  the  Executive  Council  on 
Integrity  and  Efficiency.  The  prior  version  of  this  publication  was  issued  by  the  two  predecessor 
organizations  in  January  2005  and  was  revised  by  CIGIE  in  January  2011. 
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Table  A.  Assignments  Selected  for  Review  by  Assignment  Type  and  by  Region  and 

Field  Detachment 


DCAA  REGION  OR  FIELD  DETACHMENT 

Type  of 
Assignment 

Total 

Number  of 
Assignments 
Selected 

Central 

Eastern 

Northeastern 

Mid- 

Atlantic 

Western 

Field 

Detachment 

Forward 

Pricing52 

21 

4 

3 

4 

3 

5 

2 

Internal 

Control 

System 

Reviews53 

7 

2 

2 

1 

1 

1 

0 

Incurred 

Cost 

Audits54 

12 

3 

1 

2 

2 

2 

2 

All  Other55 

10 

0 

3 

2 

3 

1 

1 

Total 

Assignments 

Reviewed 

50 

9 

9 

9 

9 

9 

5 

In  addition,  we  reviewed  all  work  referenced  in  the  selected  assignments  including  work 
perfonned  in  other  assignments.  Infonnation  on  the  deficiencies  identified  by  individual 
assignments  reviewed  can  be  found  in  Appendix  B,  Summary  of  Review  Findings  by 
Assignment. 

Use  of  Computer-Processed  Data 

We  did  not  rely  on  any  computer-processed  data  as  part  of  our  review. 

Prior  Coverage 

During  the  last  5  years,  the  GAO  and  DOD  IG  have  issued  12  reports  related  to  similar 
issues  with  DCAA  that  are  addressed  in  this  report.  The  unrestricted  GAO  reports  can  be 
accessed  over  the  Internet  at  http://www.gao.gov/,  and  unrestricted  DOD  Inspector 
General  reports  can  be  accessed  at  http://www.dodig.mil. 


52  Forward  pricing  assignments  included  forward  pricing  proposal  audits,  forward  pricing  rate  agreement 
audits,  pre-award  accounting  system  reviews,  parts  of  a  proposal  audits,  and  agreed-upon  procedures 
attestation  engagements. 

53  Internal  Control  Systems  Reviews  included  a  cross  section  of  the  various  10  internal  control  system 
reviews  as  explained  in  the  ‘Evidence’  section  of  this  report. 

4  Incurred  Cost  Audits  deal  with  establishing  final  indirect  rates  and  auditing  the  indirect  and  direct  costs 
for  the  contractor’s  fiscal  year. 

55  All  Other  assignments  included  a  postaward  audit,  operations  audit,  termination,  floor  check,  equitable 
adjustment,  financial  capability,  two  Cost  Accounting  Standards  compliance  reviews,  and  two  special 
assignments. 
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GAO 

GAO  Report  No.  GAO- 12-88,  “Actions  Needed  to  Improve  DCAA’s  Access  to  and  Use 
of  Defense  Company  Internal  Audit  Reports,”  December  2011 

GAO  Report  No.  GAO-09-468,  “Widespread  Problems  with  Audit  Quality  Require 
Significant  Reform,”  September  2009 

GAO  Report  No.  GAO-08-857,  “DCAA  AUDITS:  Allegations  That  Certain  Audits  at 
Three  Locations  Did  Not  Meet  Professional  Standards  Were  Substantiated,” 

July  22,  2008 

DOD  IG 

DOD  IG  Report  No.  DODIG-2013-015,  “Actions  to  Align  Defense  Contract 
Management  Agency  and  Defense  Contract  Audit  Agency  Functions,” 

November  13,  2012 

DOD  IG  Report  No.  DODIG-20 12-038,  “Hotline  Complaint  Concerning  Inadequate 
Audit  Services  Provided  by  an  Audit  Team  in  the  Defense  Contract  Audit  Agency  Mid- 
Atlantic  Region,”  January  10,  2012 

DOD  IG  Report  No.  D-201 1-6-01 1,  “Report  on  Hotline  Allegation  Regarding  Lack  of 
Agency  Guidance  on  the  Currency  of  Audit  Testing  in  the  Defense  Contract  Audit 
Agency,”  September  21,  2011 

DOD  IG  Report  No.  D-201 1-6-010,  “Report  on  Failure  of  Defense  Contract  Audit 
Agency,  Santa  Ana  Branch  Office  to  Provide  Adequate  Support  in  Response  to  a  Request 
for  Review  of  Interim  Public  Vouchers,”  September  2,  201 1 

DOD  IG  Report  No.  D-201 1-6-004,  “Report  on  Quality  Control  Review  of  the  Price 
Waterhouse  Coopers,  LLP  and  Defense  Contract  Audit  Agency  FY  2008  Single  Audit  of 
the  Charles  Stark  Draper  Laboratory,  Incorporated,”  February  28,  2011 

DOD  IG  Report  No.  D-201 1-6-002,  “Report  on  Quality  Control  Review  of  Deloitte  & 
Touche,  LLP  and  DCAA  FY  2008  Single  Audit  of  the  Aerospace  Corporation,” 

October  29,  2010 

DOD  IG  Report  No.  D-2009-6-009,  “Audit  Work  Deficiencies  and  Abusive  Work 
Environment  Identified  by  the  Government  Accountability  Office,”  August  31,  2009 

DOD  IG  Report  No.  D-2007-6-006,  “Review  of  the  Defense  Contract  Audit  Agency 
Quality  Control  System,”  May  1,  2007 

DOD  IG  Report  No.  D-2007-6-005,  “Congressional  Inquiry  Concerning  Allegations  at 
the  Defense  Contract  Audit  Agency  Lockheed  Martin  Rockville  Resident  Office,” 

April  25,  2007 
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Appendix  B.  Summary  of  Deficiencies 
Identified  With  Government  Auditing 
Standards  By  Individual  Assignment 

The  schedule  beginning  on  the  next  page  summarizes  our  findings  for  each  of  the 
50  assignments  we  reviewed.  The  schedule  provides  our  assessment  of  whether  the 
assignment  complied  with  the  GAGAS  requirements  for  Professional  Judgment, 
Independence,  Competence,  Quality  Control,  Planning,  Evidence,  Documentation, 
Supervision,  and  Reporting.  Assignments  in  rows  1  through  47  in  the  schedule  were 
performed  as  examination  engagements;  assignments  in  rows  48  and  49  were  perfonned 
as  agreed-upon  procedures  engagements;  and  the  assignment  listed  in  row  50  was 
perfonned  as  a  performance  audit.  A  “Yes”  response  in  the  column  indicates  that  the 
assignment  complied  with  the  standard  and  a  “No”  response  indicates  that  the  assignment 
did  not  comply  with  the  standard. 
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Summary  of  Deficiencies  with  Government  Auditing  Standards  Identified  by  Individual  Assignment 


ASSIGNMENT  NUMBER 

PROFESSIONAL 

JUDGMENT 

INDEPENDENCE 

COMPETENCE 

QUALITY  CONTROL 

PLANNING 

COMMUNICATION 

EVIDENCE 

DOCUMENTATION 

SUPERVISION 

REPORTING 

9851-2005FI01000I4 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

9731-2007B1 0100017 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

6161-2005A1 01 00022 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

3541-2008K 10 100001 

Yes 

Yes 

Yes 

Yes 

Yes 

No 

Yes 

Yes 

Yes 

Yes 

3171  -2006 J 101 00002 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

220 1-2006F10 100003 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

4281 -2005A1 0 1 00006 

No 

Yes 

Yes 

No 

No 

No 

No 

Yes 

No 

No 

1271-2007S1010001 1 

Yes 

Yes 

Yes 

No 

Yes 

No 

Yes 

Yes 

Yes 

Yes 

2161-2006P10100005 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

41 71-2006G 10 100007 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

3201-2007G101 00023 

Yes 

Yes 

Yes 

Yes 

Yes 

No 

Yes 

No 

Yes 

Yes 

6151-2007N10 100001 

No 

Yes 

Yes 

No 

Yes 

No 

No 

No 

No 

No 

DEFECTIVE  PRICING/POST  AWARD  REVIEW 

6341-2008D42000026 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

FLOOR  CHECK 

621 1-2009C13500003 

No 

No 

No 

No 

No 

No 

No 

No 

No 

No 

TERMINATION 

1241-2009H171 00003 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

EQUITABLE  ADJUSTMENT 

2901-2010A1 7200001 

Yes 

Yes 

Yes 

No 

Yes 

No 

Yes 

Yes 

Yes 

Yes 

FINANCIAL  CAPABILITY 

1 62 1-201 0C17600001 

Yes 

Yes 

Yes 

Yes 

Yes 

No 

Yes 

Yes 

Yes 

Yes 

"No"  indicates  assignment  did  not  comply  with  the  specific  standard. 

"Yes"  indicates  assignment  complied  with  the  specific  standard. 

If  Professional  Judgment  indicates  a  "No"  response,  Supervision,  Quality  Control,  and  Reporting  will  also  indicate  "No"  responses. 
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Summary  of  Deficiencies  with  Government  Auditing  Standards  Identified  by  Individual  Assignment 


ASSIGNMENT  NUMBER 

PROFESSIONAL 

JUDGMENT 

INDEPENDENCE 

COMPETENCE 

QUALITY  CONTROL 

PLANNING 

COMMUNICATION 

EVIDENCE 

DOCUMENTATION 

SUPERVISION 

REPORTING 

SPECIAL  AUDIT 

1661-2009H 17900002 

Yes 

No 

Yes 

No 

No 

No 

Yes 

Yes 

Yes 

Yes 

490 1-2008W 179000 10 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

COST  ACCOUNTING  STANDARDS 

981 1-2009A19100001 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

614 1-2008M 194 18001 

No 

Yes 

Yes 

No 

Yes 

No 

No 

No 

No 

No 

INTERNAL  CONTROL  SYSTEM  REVIEWS 

2641-2009C1 1010001 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

4301-2009H1 1020002 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

331 1-2008C1 1070001 

No 

No 

Yes 

No 

No 

No 

No 

No 

No 

No 

6381-2009G1 1590001 

Yes 

Yes 

Yes 

No 

No 

No 

No 

Yes 

No 

Yes 

1721-2009B 14980001 

No 

No 

Yes 

No 

Yes 

No 

No 

No 

No 

No 

1 261-20 10A1 2030001 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

3191-2009F13010001 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

FORWARD  PRICING 

3531-2009L2100001 1 

Yes 

Yes 

Yes 

No 

No 

No 

Yes 

Yes 

No 

Yes 

986 1-2009P2 1000019 

No 

Yes 

No 

No 

No 

No 

No 

No 

No 

No 

1461-2010D2 1000003 

Yes 

Yes 

Yes 

No 

Yes 

No 

Yes 

No 

No 

Yes 

3121-2009H2 1000024 

No 

Yes 

Yes 

No 

No 

No 

No 

Yes 

No 

No 

6321-2009U23000001 

No 

Yes 

Yes 

No 

No 

No 

No 

Yes 

No 

No 

2651-2009H23000006 

No 

Yes 

Yes 

No 

No 

No 

No 

Yes 

No 

No 

1301-2009B23000004 

No 

Yes 

Yes 

No 

No 

No 

No 

Yes 

No 

No 

4181  -2009 A23000002 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

"No"  indicates  assignment  did  not  comply  with  the  specific  standard. 

"Yes"  indicates  assignment  complied  with  the  specific  standard. 

If  Professional  Judgment  indicates  a  "No"  response,  Supervision,  Quality  Control,  and  Reporting  will  also  indicate  "No"  responses. 
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Summary  of  Deficiencies  with  Government  Auditing  Standards  Identified  by  Individual  Assignment 


ASSIGNMENT  NUMBER 

PROFESSIONAL 

JUDGMENT 

INDEPENDENCE 

COMPETENCE 

QUALITY  CONTROL 

PLANNING 

COMMUNICATION 

EVIDENCE 

DOCUMENTATION 

SUPERVISION 

REPORTING 

2501-2010H2 1000002 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

1251-2009F2 1000006 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

3561-2009D2 10000 13 

Yes 

Yes 

Yes 

No 

Yes 

No 

No 

No 

Yes 

Yes 

280 1-2009G2 1000041 

No 

Yes 

Yes 

No 

Yes 

No 

No 

No 

No 

No 

472 1-201 0L2 1000001 

No 

Yes 

Yes 

No 

Yes 

No 

No 

No 

No 

No 

4261-2009T2 1000003 

Yes 

Yes 

Yes 

No 

Yes 

No 

Yes 

Yes 

No 

Yes 

PARTS  OF  A  PROPOSAL 

9761-2009T27000040 

Yes 

Yes 

No 

No 

Yes 

No 

Yes 

Yes 

Yes 

Yes 

352 1-20 10V27000003 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

221 1-2010N27000001 

No 

Yes 

Yes 

No 

Yes 

No 

No 

No 

No 

No 

6701-2010S27000002 

Yes 

Yes 

Yes 

Yes 

Yes 

No 

Yes 

Yes 

Yes 

Yes 

ACCOUNTING  SYSTEM  REVIEW 

643 1-2009B1 77400 13 

No 

No 

Yes 

No 

No 

No 

No 

No 

No 

No 

SUBTOTAL  (NUMBER  OF 
EXAMINATION 

ENGAGEMENTS  WITH  "NO" 
RESPONSES) 

34 

5 

3 

43 

31 

47 

36 

32 

38 

34 

AGREED-UPON  PROCEDURES 

4141-2009B28000001 

No 

Yes 

No 

No 

No 

No 

No 

Yes 

No 

No 

4601-2010S28000001 

No 

Yes 

No 

No 

No 

No 

No 

No 

No 

No 

224 1-2009B 1050 1001 

No 

Yes 

Yes 

No 

No 

No 

No 

No 

No 

No 

SUBTOTAL  (NUMBER  OF 
OTHER  ENGAGEMENTS 

WITH  "NO"  RESPONSES) 

3 

0 

2 

3 

3 

3 

3 

2 

3 

3 

GRAND  TOTAL  (NUMBER  OF 
ALL  ENGAGEMENTS  WITH 
"NO"  RESPONSES) 

37 

5 

5 

46 

34 

50 

39 

34 

41 

37 

"No"  indicates  assignment  did  not  comply  with  the  specific  standard. 

"Yes"  indicates  assignment  complied  with  the  specific  standard. 

If  Professional  Judgment  indicates  a  "No"  response,  Supervision,  Quality  Control,  and  Reporting  will  also  indicate  "No"  responses. 
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Defense  Contract  Audit  Agency  Comments 


DEFENSE  CONTRACT  AUDIT  AGENCY 
DEPARTMENT  OF  DEFENSE 
8725  JOHN  J.  KINGMAN  ROAD,  SUITE  2135 
FORT  BELVOIR,  VA  22060-6219 


September  17,  2012 

MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL  FOR  AUDIT 

POLICY  AND  OVERSIGHT,  OFFICE  OF  THE  INSPECTOR 
GENERAL,  DEPARTMENT  OF  DEFENSE 

SUBJECT:  Response  to  Office  of  Inspector  General,  Department  of  Defense,  Draft  Report, 

Monitoring  of  the  Quality  of  the  Defense  Contract  Audit  Agency  Audits  (Project  No. 
D2010-DIP0AC-01 15.000) 

Thank  you  for  the  opportunity  to  respond  to  the  subject  draft  report  provided  to  DCAA 
on  August  2,  2012.  The  issues  discussed  in  the  report  are  important.  However,  the  utility  of  the 
report  is  very  limited  because  the  findings  are  based  on  old  data  and  do  not  reflect  the  current 
state  of  the  Agency. 

The  majority  of  the  audit  work  reviewed  by  DoDIG  occurred  between  2006  and  2009 — 
more  than  three  years  ago.  As  a  result,  the  findings  are  similar  to  those  in  a  Government 
Accountability  Office  (GAO)  report  issued  in  September  2009.  We  took  decisive  actions  and 
made  major  changes  to  correct  the  problems  GAO  identified.  However,  the  DoDIG  report 
focuses  on  work  done  prior  to  or  immediately  following  the  issuance  of  the  GAO  report,  and, 
therefore,  does  not  recognize  the  significant  progress  we  have  made  during  the  past  three  years. 

DCAA  actions  to  improve  audit  quality  and  training  include  the  following: 

Audit  Quality 

•  Integrity  and  Quality  Assurance  Directorate:  We  established  this  office  in  FY  2009  to 
conduct  Agency-wide  comprehensive  quality  assurance  reviews  that  measure  our  overall 
audit  quality  and  guide  the  development  of  our  auditor  training.  The  head  of  this  office 
reports  directly  to  the  Director  of  DCAA  to  ensure  that  quality  issues  receive  top-level 
attention. 

•  Field  Audit  Office  (FAQ)  Assistant  for  Quality:  In  FY  2010  we  established  this  position 
at  FAOs  to  provide  field  level  support  to  help  ensure  that  audits  are  of  the  highest 
quality  and  in  accordance  with  professional  standards. 

•  Revised  audit  programs:  We  issued  new  and  significantly  revised  audit  programs  based 
on  recent,  relevant  audit  challenges,  resulting  in  more  accurate  and  consistent 
application  of  audit  procedures. 
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•  Independent  referencing:  In  July  201 1  we  issued  guidance  that  required  that  an 
experienced  auditor  (such  as  a  supervisor  or  technical  specialist)  who  did  not  work  on 
the  assignment  being  reviewed  would  conduct  an  independent  reference  review  of  the 
audit  report  to  ensure  that  the  information  in  the  report  is  fully  supported  by  sufficient 
appropriate  evidence  in  the  working  papers. 

•  Enhanced  statistical  sampling:  We  made  our  sampling  guidance  more  rigorous  in  June 
2010  so  that  our  sample  results  would  have  a  90-percent  confidence  level. 

Training 

•  Agency-wide  Quality  Training:  We  developed  this  intensive,  three-day  training 
program  as  the  foundation  of  our  efforts  to  improve  audit  quality  after  the  GAO  report. 
We  conducted  this  training  at  each  of  our  1 12  Field  Audit  Office  locations  during 
December  2010  to  April  2011  to  ensure  that  all  auditors  had  a  better  understanding  of 
quality  expectations. 

•  Training  After  Quality  Assurance  Reviews:  We  began  giving  this  on-site  training  in 
June  201 1  and  we  have  continued  to  give  it  to  local  auditors  at  the  conclusion  of  each 
quality  assurance  review  to  focus  on  the  specific  problems  found  during  the  review  to 
ensure  that  any  needed  corrective  action  is  fully  understood  and  taken  promptly. 

•  Supervisory  Auditor  Assignment  Review  Process  Workshop:  We  developed  this 
course  as  a  result  of  our  internal  quality  assurance  reviews,  and  it  is  being  given  to  all 
supervisory  auditors  to  explain  their  roles  and  responsibilities  in  the  audit  process.  This 
training  began  in  May  2012  and  is  scheduled  to  be  completed  in  January  2013. 

•  Agency-wide  GAGAS  Training:  This  detailed  1 1 -hour  online  course  on  Generally 
Accepted  Government  Auditing  Standards  was  taken  by  all  auditors  in  FY  2010  and  by 
all  subsequently  hired  auditors. 

As  a  result  of  these  and  other  actions,  we  have  made — and  are  continuing  to  make — 
major  progress  in  increasing  our  audit  quality.  We  concur  in  principle  with  many  of  the 
recommendations  in  this  DoDIG  report;  as  we  have  indicated,  we  had  already  begun  or 
completed  similar  corrective  actions  in  response  to  the  earlier  GAO  report.  Our  specific 
responses  to  your  recommendations  are  attached. 


Director 

Attachment: 

As  stated 
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DCAA  Responses  to  DoDIG  Recommendations  (Project  No.  D2010-DIP0AC-01 1 5.000) 

DoDIG  Recommendation  1:  We  recommend  that  the  Director,  Defense  Contract  Audit 
Agency:  Direct  each  audit  office  to  take  the  headquarters-determined  corrective  action(s)  for 
assignments  listed  in  Appendix  B  as  not  demonstrating  professional  judgment.  Corrective  actions 
should  include: 

a.  Rescinding  the  reports  and  notifying  those  who  received  the  reports  not  to 
rely  on  them,  or  performing  additional  work  and  supplementing  the  original 
report,  whichever  action  is  most  appropriate  depending  on  how  contracting 
officers  are  using  or  relying  on  the  report  or  information  in  the  report. 

b.  Inserting  into  the  engagement  or  audit  documentation  file  a  memorandum 
stating  that  the  engagement  or  audit  did  not  comply  with  government 
auditing  standards,  the  work  should  not  be  relied  on  for  other  engagements 
or  audits,  and  the  assignment  should  not  be  used  as  an  example  to  perform 
other  engagements  or  audits. 

c.  Reviewing  the  deficiencies  identified  in  the  various  assignments  and 
taking  appropriate  corrective  actions  regarding  the  audit  staff 
involved  to  include  additional  training  when  warranted. 

DCAA  Response: 

Recommendation  la:  Concur  in  principle. 

Because  the  audit  reports  in  question  were  issued  a  number  of  years  ago,  many  of  their  related 
actions  likely  have  been  completed  and/or  the  reports  are  irrelevant  due  to  subsequent  events  or 
the  passage  of  time.  Nevertheless,  DCAA  is  committed  to  taking  the  actions  necessary  to  adhere 
to  auditing  standards  and  protect  the  Government’s  interest.  DCAA  will  assess  the 
circumstances  for  the  reports  DoDIG  notes  as  not  demonstrating  professional  judgment 
(Appendix  B)  and  determine  the  appropriate  actions  in  each  circumstance.  In  order  to  perform  this 
assessment  without  unnecessarily  duplicating  work  already  performed  by  the  DoDIG,  we  need 
additional  information  from  the  DoDIG  on  the  noncompliances  with  Generally  Accepted 
Government  Auditing  Standards  (GAGAS)  and  the  specifics  leading  to  those  conclusions.  We 
expect  to  complete  these  actions  by  June  30,  2013. 

Recommendation  lb:  Concur. 

For  assignments  DoDIG  notes  as  not  demonstrating  professional  judgment  (Appendix  B),  we 
will  include  a  memorandum  in  the  applicable  audit  documentation  file  stating  that  the  engagement 
did  not  comply  with  government  auditing  standards  and  that  the  work  should  not  be  relied  on  or 
used  as  an  example  for  other  engagements.  We  expect  to  complete  these  actions  by  December 
31,2012. 

Recommendation  1c:  Concur  in  principle. 

The  action  to  address  the  intent  of  the  recommendation  is  complete.  As  discussed  in  our 
response  to  Recommendation  2  below,  since  FY  2009,  DCAA  has  taken,  and  continues  to  take, 
significant  steps  to  improve  audit  quality  and  limit  similar  shortcomings  in  future  audits.  These 
steps  include  extensive  training  of  all  DCAA  audit  staff,  which  includes  the  staff  involved  in 
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those  assignments  DoDIG  identified  as  not  demonstrating  professional  judgment. 

DoDIG  Recommendation  2:  Re-emphasize  the  importance  of  compliance  with  government 
auditing  standards  and  applicable  Defense  Contract  Audit  Agency  policies  and  procedures 
through  issuance  of  alerts  or  other  appropriate  memorandums  detailing  the  various  deficiencies 
identified,  causes,  and  corrective  actions  to  be  taken  by  all  audit  offices. 

DCAA  Response:  Concur  in  principle. 

The  action  to  address  this  recommendation  is  complete.  Since  FY  2009,  DCAA  has  taken,  and 
continues  to  take,  significant  steps  to  improve  audit  quality  such  as  providing  extensive  training 
and  issuing  a  significant  number  of  audit  guidance  memorandums.  Although  it  will  take  time  to 
realize  the  full  effect  of  the  completed  and  continuing  corrective  actions,  we  have  already  seen 
tangible  results.  For  example,  in  recent  quality  assurance  reviews,  the  results  for  a  number  of 
field  audit  offices  show  that  all  audits  met  the  overarching  GAGAS  general  standard  related  to 
professional  judgment.  We  believe  that  the  following  portfolio  of  efforts — both  completed  and 
in  process — satisfies  the  intent  of  your  recommendation. 

Training  to  support  compliance  with  GAGAS 

Training  Initiative  on  Performing  Quality  Audits.  Three-day  comprehensive  training  sessions 
were  delivered  Agency-wide  at  1 12  field  audit  offices  between  December  2010  and  April  201 1 . 
The  training  sessions  focused  on  performing  quality  audits  and  were  comprised  of  the  following 
key  elements:  (1)  understanding  the  request  for  audit,  the  basis  of  the  contractor’s  assertion  and 
planning  the  appropriate  audit;  (2)  conducting  and  documenting  efficient  and  effective  audits; 

(3)  developing  and  reporting  sound  audit  conclusions;  and  (4)  reviewing  the  results  of  internal 
quality  assurance  reviews  related  to  various  noncompliances  with  GAGAS  and/or  Agency  policy 
and  procedures,  their  root  causes,  and  corrective  actions. 

GAGAS  Training  (on-line  course  1440).  An  1 1-hour  continuing  professional  education  (CPE) 
course  was  developed  by  the  Defense  Contract  Audit  Institute  and  first  offered  in  April  2010. 

All  auditors  are  required  to  take  this  course  that  emphasizes  the  level  of  assurance  for  the  various 
types  of  engagements  and  provides  guidance  on  auditor  independence,  planning,  fraud  risk,  level 
of  testing,  supervision,  auditor  judgment,  audit  documentation  and  reporting. 

Field  Audit  Office  (FAO)  Assistant  for  Quality.  This  position,  created  in  July  2010,  is  located  in 
field  audit  offices.  The  individual  supports  the  FAO  Manager  by  assisting  with  a  variety  of 
audit-related  assignments,  audit  processes,  and/or  audit  interim  and  pre-issuance  reviews  of  FAO 
audits  and  audit  reports.  This  support  involves  a  review  of  audit  work  to  ensure  compliance  with 
GAGAS.  A  three-day  training  session  was  developed  in  FY  2012  and  is  being  delivered  to  the 
FAO  Assistants  for  Quality  in  each  region.  The  training  covers:  (1)  updates  to  audit  policy 
guidance,  risk  assessment  requirements,  and  statistical  sample  requirements;  (2)  guidance  on  pre¬ 
issuance  and  interim  reviews  of  audits;  and  (3)  discussion  of  key  findings  from  internal  quality 
assurance  reviews.  The  training  has  been  institutionalized,  will  be  updated  for  current  issues, 
and  provided  semi-annually. 
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Integrity  and  Quality  Assurance  Directorate  Webpage.  The  webpage  provides  auditors  real-time 
results  of  internal  quality  assurance  reviews,  specific  examples  of  noncompliances  with 
government  auditing  standards  and/or  applicable  Defense  Contract  Audit  Agency  policies  and 
procedures.  The  webpage  also  includes  recommendations  to  avoid  similar  noncompliances  in  the 
future. 

Supervisory  Auditor  Assignment  Review  Process  Workshop.  This  training  is  being  delivered  to 
all  Supervisory  Auditors,  Agency-wide,  from  May  2012  through  January  2013.  The  supervisor 
has  the  fundamental  responsibility  of  ensuring  that  each  assignment  is  conducted  in  accordance 
with  GAGAS.  The  training  focuses  on  the  role  of  the  supervisor  in  an  engagement  during  initial 
planning  phase,  risk  assessment  phase,  interim  review  phase,  and  final  supervisory  review  phase. 
Arrangements  have  been  made  for  the  DoDIG  to  observe  five  of  the  workshops. 

FAO  Manager's  Conferences.  These  conferences  were  held  in  December  2010  and  November 
2011,  and  another  is  planned  for  November  2012.  At  the  20 1 1  conference,  the  Undersecretary  of 
Defense,  Comptroller,  discussed  the  importance  of  performing  quality  audits  that  protect  the 
public  interest.  At  each  conference,  the  DCAA  Assistant  Director  of  Integrity  and  Quality 
Assurance  presented  the  results  of  recent  quality  assurance  reviews.  His  presentation  focused  on 
ensuring  GAGAS  compliance,  including  pertinent  issues,  root  causes  of  problems,  and  specific 
recommendations. 

Memorandums  to  the  workforce 

DCAA’s  audit  guidance  memorandums  are  both  emailed  to  the  workforce  and  posted  on  the 
DCAA  intranet.  The  following  is  a  list  of  key  memorandums  DCAA  issued  to  increase  our 
effectiveness  in  terms  of  audit  quality.  DCAA  will  keep  the  DoDIG  apprised  of  additional 
memorandums  as  they  are  disseminated. 


Date 

Memorandum  for 
Regional  Director 
(MRD)  No. 

Subject 

October  9,  2009 

09-PAS-019(R) 

Mandatory  Training  -  CMTL  1269  Working  Paper 
Documentation 

October  22,  2009 

Q  720.7.A 

Recurring  Issues  Commonly  Found  in  Quality 
Assurance  Reviews 

April  14,2010 

Q  720.7.A 

Recurring  Issues  Commonly  Found  in  Quality 
Assurance  Reviews 

September  16,  2010 

10-PAS-025(R) 

FY  2010  Annual  Training  on  the  Generally 
Accepted  Government  Auditing  Standards 
(GAGAS)  Independence  Standards 

October  20,  20 1 0 

10-OTS-069(R) 

Guidance  on  Attribute  Sampling  Policy 
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December  15,  2010 

10-PAS-035(R) 

Audit  Guidance  on  Contractor  Notification  Letters 

January  3, 201 1 

1  l-OTS-01 1(R) 

Guidance  on  Variable  Sampling  Policy 

July  7,  2011 

11 -PAS-0 10(R) 

Audit  Alert  on  Timely  Resolution  oflndependence 
Impairments 

July  26,  2011 

1 1  -PPS-0 1 2(R) 

Audit  Guidance  on  Independent  Reference 

Reviews 

December  14,  201 1 

1 1-PAC-021(R) 

Audit  Alert  on  Performance  of  Audit  Steps  to  Test 
Cost  Accounting  Practices  for  Compliance  with 

Cost  Accounting  Standards  in  Current  Audits 

April  24,  2012 

12-PAS-012(R) 

Audit  Guidance  on  Auditing  Contractor  Business 
Systems  and  Contractor  Compliance  with  DFARS 
252.242-7006,  Accounting  System  Administration 

May  2,  2012 

12-PAS-015(R) 

Audit  Guidance  on  Performing  Sufficient  Testing 

July  25,  2012 

1 2-PPS-0 1 8(R) 

Audit  Guidance  -  Denial  of  Access  to  Records 

Due  to  Contractor  Assertion  of  Attomey-Work- 
Product  Doctrine  or  Attorney-Client  Privilege 

DoDIG  Recommendation  3:  Emphasize  to  the  audit  staff  the  importance  of  reporting  and 
elevating  all  access  to  records  issues  following  the  established  DCAA  process  and 
procedures. 

DCAA  Response:  Concur  in  principle. 

The  action  to  address  this  recommendation  is  complete.  The  Training  Initiative  on  Performing 
Quality  A  udits  (discussed  in  our  response  to  Recommendation  2)  included  a  presentation  on 
access  to  records  issues.  The  training  material  emphasized  the  importance  of  following  the 
established  DCAA  process  and  procedures,  including  elevating  all  access  to  records  issues.  In 
addition,  DCAA's  annual  independence  training  (online  course  9022,  updated  annually)  was 
revised  in  September,  2010,  to  emphasize  the  importance  of  following  procedures  and  elevating 
access  to  records  issues.  Finally,  on  July  25,  2012,  DCAA  issued  additional  guidance  (MRD  12- 
PPS-01 8)  to  address  access  to  records  issues  involving  the  assertion  of  attorney-client  privilege 
or  attorney-work -product  doctrine. 


DoDIG  Recommendation  4:  Revise  existing  guidance  on  handling  access  to  records  issues  to 
instruct  audit  offices  to  consider  whether  a  contractor’s  policies  or  procedures  could  not  only 
impede  the  audit  office’s  own  engagement  or  audit  but  another  audit  office’s  engagement  or 
audit. 
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DCAA  Response:  Nonconcur. 

The  circumstances  that  appear  to  have  prompted  this  recommendation  are  described  on  page  10 
of  the  DoDIG  draft  report.  Those  circumstances  involved  DCAA  access  to  information  that  the 
contractor  considered  to  be  particularly  sensitive.  Based  on  our  review  of  FAO  correspondence 
related  to  this  issue,  the  FAO  vigorously  pursued  access  to  the  information.  Arrangements  were 
made  that  addressed  the  contractor’s  concerns  while,  at  the  same  time,  enabled  DCAA  access  to 
the  information  necessary  to  meet  the  audit  objectives.  The  FAO  informed  the  DoDIG  that  the 
arrangement  did  not  negatively  impact  its  review.  The  DoDIG  notes  that  during  a  discussion 
with  the  FAO,  a  contractor  representative  stated  that  the  contractor  wanted  to  restrict  all  DCAA 
access  to  the  document  in  question;  however,  there  was  no  indication  that  the  restriction  was 
imposed.  Nonetheless,  based  on  these  circumstances,  the  DoDIG  concluded  that  by  not  formally 
notifying  the  contractor  that  the  arrangement  only  applied  to  the  particular  engagement,  the  FAO 
caused  a  potential  access  issue,  as  well  as  an  independence  impairment  in  general.  As  a  result  of 
their  conclusions,  they  recommended  that  DCAA  revise  its  guidance  to  address  such 
circumstances. 

We  disagree  with  the  DoDIG’s  conclusion  and  recommendation.  GAGAS  requires  auditors  to 
be  independent  in  all  matters  related  to  the  audit  work  (GAGAS  3.02).  There  was  no  impairment 
for  this  audit  because  the  FAO  was  able  to  make  reasonable  arrangements  for  access  to 
information  sufficient  to  meet  the  audit  objectives.  One  cannot  assume  that  there  will  be  an 
impairment  to  independence  for  future  audits  simply  based  on  a  verbal  statement  made  by  a 
contractor  representative  that  the  contractor  wanted  to  restrict  all  DCAA  access  to  a  particular 
document.  Such  a  statement  is  not  a  policy  to  deny  or  an  actual  denial  of  access.  Any  future 
issues  related  to  access  to  records  would  be  appropriately  covered  by  DCAA’s  policy  on  denial 
of  access  to  records. 

We  believe  that  our  access  to  records  guidance  (including  DCAA  Instruction  7640.17)  is 
comprehensive  and  sufficient  to  address  contractor  denial  of  access  to  records  issues  without 
being  overly  prescriptive.  Circumstances  related  to  access  to  contractor  records  vary 
significantly,  and  FAOs  need  to  have  flexibility  to  exercise  professional  judgment  on  a  case-by- 
case  basis.  Our  guidance  already  requires  FAOs  to  notify  contractors  in  writing  if  the  FAO 
believes  contractor  policies  and  procedures  will  invoke  unreasonable  delays,  waste  audit  time,  or 
otherwise  impede  the  orderly  progress  of  the  audit.  We  see  no  benefit  in  establishing  a  policy 
that  would  require  formal  notification  to  contractors  regarding  “potential  access  issues”  based  on 
verbal  comment  made  by  a  contractor  representative. 

DoDIG  Recommendation  5:  Improve  the  effectiveness  of  Defense  Contract  Audit  Agency 
training  by: 

a.  Performing  a  comprehensive  review  and  analysis  of  the  Defense  Contract  Audit 
Agency  continuing  professional  education  training  program,  including  course 
curriculum,  content  and  delivery  methods,  to  identify  appropriate  areas  for 
enhancement  of  the  individual  and  collective  competency  of  its  staff. 
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b.  Using  outside  sources  for  certain  core  training  courses  to  supplement  existing 
Defense  Contract  Audit  Agency  training  courses  in  various  areas,  including  but  not 
limited  to,  government  auditing  standards,  internal  controls  and  related  systems 
reviews,  and  American  Institute  of  Certified  Public  Accountants  attestation 
standards. 

c.  Performing  an  analysis  for  the  implementation  of  a  robust  on-the-job  coaching  program 
to  provide  auditors  and  supervisors  more  hands-on  training  regarding  proper  application 
and  interpretation  of  government  auditing  standards  and  related  American  Institute  of 
Certified  Public  Accountants  attestation  standards. 

DCAA  Response: 

Recommendation  5a:  Concur  in  Principle. 

DCAA  continually  strives  to  deliver  effective  training.  For  example,  DCAA  has  integrated 
training  on  government  auditing  standards  and  related  American  Institute  of  Certified  Public 
Accountants  (A1CPA)  attestation  standards  into  several  training  courses  and  workshops  for 
auditors,  supervisors,  and/or  FAO  assistants  for  quality.  These  are  described  in  the  response  to 
Recommendations  2  and  5.b.  DCAI  has  also  reviewed  all  courses  to  ensure  that  GAGAS 
requirements  are  fully  addressed  when  pertinent  to  the  subject  matter.  In  addition,  the  DCAA 
Advisory  Council  on  Learning  and  Talent  Development  has  undertaken  a  project  to  review  the 
DCAI  curriculum,  delivery  methods,  and  locations.  Initial  results  are  expected  by  September  30, 
2012.  The  timeframe  for  implementation  of  Council  recommendations  will  be  established  once 
they  are  known. 

Recommendation  5b:  Concur  in  Principle. 

The  action  to  address  this  recommendation  is  complete.  DCAA  already  makes  use  of  external 
training.  A  representative  from  the  A1CPA  provided  eight  hours  of  training  on  the  requirements 
of  GAGAS  at  the  May  2012  Quality  Workshop,  and  a  Government  Accountability  Office 
GAGAS  expert  will  give  training  on  the  201 1  revision  to  the  Yellow  Book;  this  training  will  be 
videotaped  and  distributed  Agency-wide.  We  continue  to  look  for  opportunities  to  use  external 
sources  for  training.  However,  based  on  our  recent  experience,  most  externally  prepared  training 
needs  to  be  significantly  tailored  for  our  contract  audit  environment  to  be  effective  for  our  audit 
staff.  We  have  found  that  an  effective  alternative  is  to  use  external  training  sources  as  a  resource 
when  developing  DCAA-specific  training.  For  example,  to  assist  DCAI  in  developing  course 
content  that  reflects  GAGAS,  headquarters  staff  members  have  used  concepts  from  external 
training  materials,  tailored  for  DCAA’s  contract  audit  environment. 

Recommendation  5c:  Concur  in  Principle. 

The  action  to  address  this  recommendation  is  complete.  DCAA  has  already  established  a 
coaching  program  that  is  currently  in  the  pilot  stage.  The  intent  of  the  program  is  to  improve  the 
technical  skills  and  performance  of  the  less  experienced  employee.  We  believe  that  the  coaching 
program,  along  with  the  structured  training  described  in  responses  to  Recommendations  2  and 
5.b.  addresses  the  intended  objective  of  this  recommendation. 
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DoDIG  Recommendation  6:  Revise  guidance  on  maintaining  Statements  of  Independence  to 
specify  that  all  written  explanations  describing  exceptions  to  personal  independence  provided 
to  the  first  level  supervisor  must  also  be  maintained  for  the  same  period  of  lime  as  the 
Statements. 

DCAA  Response:  Concur  in  principle. 

We  believe  that  the  new  policy  in  development  will  address  the  intended  objective  of  your 
recommendation.  We  are  in  the  process  of  revising  Agency  policy  to  provide  for  assignment 
specific  Statements  of  Independence.  Under  the  new  policy,  the  Statements  of  Independence 
will  apply  only  to  the  particular  assignment  and  the  applicable  contractor  and  will  not  include  a 
reference  to  independence  issues  related  to  other  contractors.  Therefore,  it  would  not  be 
appropriate  to  attach  a  recusal  letter  related  to  such  issues.  Further,  given  the  revised  policy, 
reviewers  should  not  need  to  see  recusal  letters  related  to  other  contractors  to  establish  that  the 
auditor  was  independent  for  that  assignment.  We  expect  to  issue  the  revised  guidance  by  June 
30,  2013. 


DoDIG  Recommendation  7:  Perform  an  assessment  of  the  new  hire  on-boarding  process  and 
implement  the  additional  steps  or  controls  needed  to  ensure  that  newly  hired  auditors  complete 
independence  training  and  submit  a  Statement  of  Independence  within  the  first  week  of  work  at 
the  audit  office  or  prior  to  working  on  any  assignment,  whichever  event  occurs  first. 

DCAA  Response:  Concur  in  Principle. 

The  action  to  address  this  recommendation  is  complete.  DCAA  has  already  performed  an 
assessment  of  the  new  hire  on-boarding  process  and  is  implementing  a  consistent  approach  for 
bringing  entry  level  auditors  into  the  Agency  from  the  day  they  accept  the  job  offer  through  their 
first  year  on  the  job.  The  on-boarding  process  includes  a  variety  of  GAGAS-related  training 
including  training  on  the  GAGAS  Independence  Standards  (on-line  course  9022),  as  well  as  a 
requirement  for  the  supervisor  to  explain  auditor  independence  and  ensure  that  the  Statement  of 
Independence  is  signed  prior  to  beginning  any  audit  work. 


DoDIG  Recommendation  8:  Issue  guidance  directing  regions,  Field  Detachment,  and  audit 
offices  to  fully  comply  with  Generally  Accepted  Government  Auditing  Standards  paragraph  3.52 
requirements  to  maintain  documentation  of  all  quality  control  procedures  performed  by  the 
regions.  Field  Detachment,  or  audit  offices  such  as  participatory  team  member  reviews  or 
regional  audit  manager  pre-release  reviews,  for  a  sufficient  amount  of  time  so  that  reviewers  can 
evaluate  the  extent  of  their  compliance  with  the  relevant  quality  control  procedure. 

DCAA  Response:  Concur  in  principle. 

We  believe  that  the  implementation  of  the  DCAA  independent  reference  review  policy,  together 
with  any  additional  actions  we  may  determine  are  appropriate  as  a  result  of  our  in-process 
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publication  system  reform  initiative,  will  address  the  intended  objective  of  this  recommendation. 

Based  on  the  discussion  on  pages  19  through  21  of  the  DoDIG  draft  report,  this  recommendation 
appears  to  have  been  prompted  because  pre-issuance  reviews  by  regional  audit  managers, 
regional  technical  specialists,  and/or  participatory  work  team  (PWT)  members  were  not 
performed  for  many  of  the  50  assignments  the  DoDIG  reviewed,  and  that  documentation  was  not 
available  for  4  of  the  24  assignments  that  required  PWT  reviews.  As  noted  in  the  DoDIG  draft 
report,  DCAA  implemented  independent  reference  reviews  in  July,  2011,  as  a  component  of  the 

Agency’s  commitment  to  provide  quality  audit  reports  in  compliance  with  applicable  auditing 
standards.  As  a  result,  the  independent  reference  review  is  DCAA’s  primary  quality  control  pre¬ 
issuance  review.  The  policy  regarding  those  reviews  is  documented  in  DCAA  lnstruction7642.1, 

Independent  Reference  Review  Policies  and  Procedures.  The  checklists  for  those  reviews  are 
delivered  automatically  by  DCAA’s  Audit  Planning  &  Performance  System  to  all  assignments 
requiring  an  independent  reference  review,  and  the  results  of  those  reviews  are  maintained  in  the 
assignment  files.  These  new  procedures  should  ensure  that  the  documentation  of  these  reviews 
is  maintained  in  accordance  with  the  GAGAS  3.52  requirement.  It  should  also  be  noted  that 

PWT  reviews  were  primarily  intended  for  audit  team  developmental  purposes  and  have  never 
been  considered  a  part  of  DCAA’s  formal  quality  control  system. 

Pages  22-25 

Regarding  pre-issuance  reviews  that  may  be  a  part  of  regional  or  FAO-specific  procedures, 

DCAA  has  already  undertaken  a  publication  system  reform  initiative,  which  includes  a  review  of 
regional  and  Field  Detachment  quality  control  publications.  One  of  the  objectives  of  the 
initiative  is  to  ensure  consistency  across  the  Agency  by  eliminating  regional  and  Field 

Detachment  publications  that  cover  areas  that  are,  or  should  be,  addressed  by  Agency-wide 
publications.  This  reform  initiative  will  include  an  assessment  of  any  regional  and  Field 

Detachment  pre-issuance  review  requirements  and  other  quality  control  requirements  to 
determine  if  they  should  be  eliminated  or  adopted  Agency- wide  in  light  of  the  Agency’s 
independent  reference  review  requirements.  We  expect  to  complete  our  assessment  by  March 

31,  2013. 

DoDIG  Recommendation  9:  Review  existing  audit  office,  regional  and  Field  Detachment 
quality  control  procedures  to  identify  best  practices  or  other  possible  quality  procedures  to  be 
implemented  that  would  be  effective  in  ensuring  audit  quality  and  compliance  with 
government  auditing  standards.  The  review  should  consider  establishing  minimum  standards 
for  regional  and  Field  Detachment  quality  control  procedures,  as  well  as  audit  office  quality 
control  procedures,  to  better  ensure  effective  implementation  of  the  DCAA  quality  control 
system. 

Renumbered 

as 

Recommend 
ation  8 

DCAA  Response:  Concur  in  principle. 

During  the  course  of  an  internal  quality  assurance  review,  the  quality  assurance  auditor  has  the 
opportunity  to  identify  audit  practices  and  processes  that  lead  to  and  maintain  audit  quality.  We 
already  communicate  these  best  practices  to  other  auditors  through  training,  presentations  at  staff 
conferences,  the  Quality  website,  and  suggestions  for  improvement  in  our  quality  assurance 
reports.  In  addition,  as  discussed  in  our  response  to  Recommendation  8,  DCAA  has  already 
undertaken  a  publication  system  reform  initiative,  which  includes  an  assessment  of  any  regional 
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and  Field  Detachment  pre-issuance  review  requirements  and  other  quality  control  requirements 
to  determine  if  they  should  be  eliminated  or  adopted  Agency-wide.  We  expect  to  complete  that 
assessment  by  March  31,  2013. 


DoDIG  Recommendation  10:  Review  the  electronic  standard  working  paper  software  and 
documents  in  the  “Audit  Planning  &  Performance  System”  to  determine  appropriate  revisions 
to  prompt  auditor  compliance  with  government  auditing  standards  and  Defense  Contract  Audit 
Agency  policies  and  procedures  such  as: 

a.  Require  the  listing  of  specific  criteria  in  the  source  section  of  each  working  paper; 

b.  Revise  all  standard  risk  assessment  working  papers  to  require  the  auditor  to  list 
the  factors  used  to  determine  the  materiality  and  sensitivity  of  the  assignment;  and 

c.  Add  a  procedure  to  the  concluding  steps  to  remind  the  auditor  that  additional 
procedures  need  to  be  considered  and  performed  when  internal  control 
deficiencies  or  potential  fraud,  illegal  acts,  abuse  or  violations  of  contract 
provisions  are  identified. 

DCAA  Response: 

Recommendation  10a:  Concur. 

We  will  make  appropriate  revisions  to  our  Audit  Planning  &  Performance  System  to  require 
working  papers  to  identify,  if  applicable,  the  specific  criteria  used  in  the  evaluation  covered  by 
the  working  paper.  We  expect  to  have  this  action  completed  by  December  3 1 ,  20 1 2. 

Recommendation  10b:  Concur  in  principle. 

The  action  to  address  this  recommendation  is  complete.  DCAA’s  current  risk  assessment 
working  papers  (working  paper  B)  for  all  applicable  assignments  already  require  auditors  to 
document  significant  materiality  and  sensitivity  factors.  For  example,  in  a  proposal  audit,  such 
factors  would  include  contract  type,  proposal  dollar  value,  basis  of  proposal,  needs  of  the 
requestor,  use  of  subcontractors,  special  Request  for  Proposal/Request  for  Quotation  provisions, 
etc.  Auditors  are  required  to  determine  the  effect  of  those  factors  on  the  proposal  being  audited; 
additionally,  the  impact  of  those  factors  is  also  considered  in  the  review  of  individual  cost 
elements. 

Recommendation  10c:  Concur  in  principle. 

The  action  to  address  this  recommendation  is  complete.  It  is  not  clear  from  the  information 
provided  in  the  report  what  DoDIG  findings  prompted  this  recommendation.  However,  the 
recommendation  appears  to  be  related  to  the  GAGAS  6.33  requirement  that  for  attestation 
engagements,  auditors  should  report,  as  applicable  to  the  objectives  of  the  engagement  and  based 
on  the  work  performed,  internal  control  deficiencies,  fraud,  illegal  acts,  abuse  and  violations  of 
contract  provisions.  The  primary  objective  of  most  DCAA  audits  is  to  evaluate  the  contractor's 
compliance  with  applicable  laws,  regulations,  and  contract  terms.  Therefore,  audit  procedures  to 
test  for  such  compliance  are  included  throughout  the  audits.  In  addition,  DCAA  has  recently 
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completed  a  project  (which  was  started  in  July  201 1)  to  revise  all  applicable  audit  programs  to 
include,  as  a  part  of  the  risk  assessment  procedures,  planning  meetings  with  the  audit  team  to 
discuss  the  risk  of  fraud  and  other  noncompliances  with  applicable  laws  and  regulations  that 
could  have  a  material  effect  on  the  audit,  and  to  design  audit  procedures  to  address  the  identified 
risk.  Furthermore,  DCAA  has  had  a  long  standing  policy  to  report  potential  internal  control 
deficiencies  identified  during  other  related  audits.  The  comprehensive  business  system  guidance 
issued  on  April  24,  2012  (MRD  12-PAS-012),  revised  and  enhanced  our  policies  and  procedures 
for  reporting  business  system  deficiencies  identified  in  other  than  business  system  audits. 


DoDIG  Reeom  mcndation  1 1 :  Revise  the  guidance  and  examples  of  Acknowledgement  and 
Notification  Letters  to  comply  with  generally  accepted  government  auditing  standard 
paragraph  6.07  on  auditor  communication  during  planning. 

DCAA  Response:  Concur. 

We  revised  DCAA’s  acknowledgement  and  notification  letters  to  state  that  an  examination-level 
attestation  engagement  will  be  performed  and  explain  what  the  attestation  engagement  consists 
of  (based  on  the  definition  of  examination  at  GAGAS  1.23a).  We  completed  this  action  on 
September  10, 2012. 

DoDIG  Recommendation  12:  Increase  the  effectiveness  of  and  compliance  with  fraud-related 
standards  by: 

a.  Developing  a  toolkit  for  auditors  to  use  when  assessing  fraud  risk  indicators  to 
determine  which  procedures  or  steps  to  include  to  cover  each  fraud  indicator  identified 
during  planning.  It  should  also  provide  information  on  determining  which  steps  to 
expand,  alternative  steps  to  perform  when  more  appropriate  than  expanding  existing 
steps,  and  include  addressing  any  fraud  indicator  found  during  the  execution  phase  of 
the  engagement; 

b.  Revising  guidance  to  include  a  revised  fraud  risk  assessment  procedure  in  which  the 
audit  team  (managers,  supervisors,  and  auditors)  discusses  the  risk  of  fraud  for  that 
engagement  and  design  procedures  to  address  the  identified  fraud  risks  as  required  by 
government  auditing  standards;  and 

c.  Revising  guidance  and  all  applicable  standard  audit  programs  to  require  the  audit  staff 
to  ask  pertinent  questions  of  appropriate  level  contractor  personnel  regarding  the 
contractor’s  assessment  of  fraud  risks  relating  to  the  assertion  or  subject  matter  of  the 
engagement. 

d.  Assess  the  August  2011  version  of  the  Fraud  Awareness  training  course  to  determine 
whether  it  covers  all  DCAA  required  processes  associated  with  identification, 
detection,  and  reporting  of  potential  fraud  and  revise  the  course,  as  needed,  to  provide 
such  coverage. 
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DCAA  Response: 

Recommendation  12a:  Concur  in  principle. 

We  believe  that  actions  already  completed,  together  with  any  additional  enhancements  as  a  result 
of  our  assessment  currently  in  process,  will  address  the  intended  objective  of  this 
recommendation.  DCAA  has  recently  completed  a  project  (which  was  started  in  July  201 1)  to 
revise  all  applicable  audit  programs  to  include,  as  a  part  of  the  risk  assessment  procedures, 
planning  meetings  with  the  audit  team  to  discuss  the  risk  of  fraud  and  other  noncompliances  with 
applicable  laws  and  regulations  that  could  have  a  material  effect  on  the  audit.  Based  on  those 
discussions  and  other  risk  assessment  procedures,  the  audit  team  designs  audit  procedures  that 
are  appropriate  in  the  particular  circumstances.  DCAA  also  has  a  project  in  place  to  assess  the 
need  for  further  enhancement  of  audit  procedures  related  to  the  risk  of  fraud.  However,  we 
disagree  with  the  DoDIG 's  specific  recommendation  to  provide  a  ‘‘toolkit”  of  steps  for  each 
fraud  indicator  because  that  approach  could  lead  to  a  ‘‘checklist  mentality.”  We  believe  that  our 
current  teaming  approach — one  that  allows  for  developing  procedures  based  on  specific 
circumstances —  encourages  critical  thinking  and  is  therefore  a  better  solution.  We  expect  to 
complete  our  assessment  by  June  30, 2013. 

Recommendation  12b:  Concur  in  principle. 

The  action  to  address  this  recommendation  is  complete.  Effort  was  started  in  July  201 1  to 
update  standard  audit  programs  to  include  a  requirement  for  the  audit  team  to  discuss  the  risk  of 
fraud  and  design  procedures  to  address  the  identified  risks.  As  of  June  2012,  DCAA  has  revised 
all  applicable  audit  programs  to  include,  as  a  part  of  the  risk  assessment  procedures,  planning 
meetings  with  the  audit  team  to  discuss  the  risk  of  fraud  and  other  noncompliances  with 
applicable  laws  and  regulations  that  could  have  a  material  effect  on  the  audit.  Based  on  these 
discussions  and  the  other  risk  assessment  procedures,  the  audit  team  designs  audit  procedures  to 
address  the  identified  fraud  risks. 

Recommendation  12c:  Concur  in  principle. 

We  believe  that  the  actions  already  completed  (as  discussed  in  our  response  to 
Recommendation  12a)  together  with  any  additional  enhancements  we  make  as  a  result  of  our 
ongoing  project,  will  address  the  intended  objective  of  this  recommendation.  The  draft  report 
states  on  page  43  that  the  2011  GAGAS  indirectly  incorporates  Statements  on  Auditing 
Standards  (SAS)  99,  which  require  audit  staff  to  inquire  of  company  management  about  its 
assessment  of  fraud  risk.  GAGAS  on  attestation  engagements  incorporates  the  AICPA’s 
Statements  on  Standards  for  Attestation  Engagements  (SSAE)  by  reference.  Paragraph 
AT  601 .33  of  the  SSAE  requires  auditors  to  consider  factors  affecting  risk  similar  to  those 
discussed  in  AU  Section  316,  Consideration  of  Fraud  in  a  Financial  Statement  Audit,  paragraph 
.85  (Appendix  to  SAS  99).  It  does  not  incorporate  all  of  SAS  99  and  the  requirement  to  inquire 
of  company  management  about  its  assessment  of  fraud  risk  is  not  one  of  the  factors  listed  in 
paragraph  .85.  Nevertheless,  DCAA  has  a  project  in  place  to  assess  whether  enhancements  are 
needed  to  supplement  guidance  related  to  the  risk  of  fraud  beyond  those  already  made. 

Consistent  with  GAGAS  6.13  (Footnote  81),  which  notes  that  SAS  99  may  provide  useful 
guidance  related  to  fraud  for  attestation  engagements,  we  are  considering  all  of  the  SAS  99 
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requirements  as  part  of  that  project.  We  expect  to  complete  our  assessment  by  June  30,  2013. 
Recommendation  1 2d:  Concur. 

DCAA  will  assess  the  August  2011  version  of  the  Fraud  Awareness  training  course  and  revise 
the  course,  as  needed,  for  changes  to  guidance  made  in  response  to  Recommendations  12.b  and 
12.c  above.  We  expect  to  complete  this  action  by  December  31,  2013. 

DoDIG  Recommendation  13:  Improve  the  effectiveness  of  supervisory  auditors  and 
compliance  with  government  auditing  standards  by: 

a.  Revising  existing  standard  electronic  working  papers  that  supervisory  auditors  use  to 
document  supervisory  guidance  and  review  to  address  specific  government  auditing 
standards  and  Defense  Contract  Audit  Agency  guidance  requirements; 

b.  Providing  additional  tools  such  as  a  link  to  suggested  potential  corrective  actions  to 
remedy  any  identified  deficiencies,  and  reminder  checklists  directly  linked  to  the 
electronic  working  paper  packages  for  supervisory  auditors  to  use  as  aids  when 
reviewing  assignments;  and 

c.  Moving  the  audit  guidance  on  performing  and  documenting  supervisory  reviews  from 
the  Defense  Contract  Audit  Agency  Contract  Audit  Manual  to  a  location  or  source 
directly  linked  to  the  electronic  working  paper  packages  so  that  the  information  is 
more  readily  available  to  users. 

DCAA  Response:  Concur  in  principle. 

DCAA  concurs  in  principle  with  Recommendations  13a,  13b,  and  13c,  and  the  action  to  address 
the  intent  of  these  recommendations  is  complete.  We  have  already  taken,  and  continue  to  take, 
steps  to  improve  the  effectiveness  of  supervisory  auditors  in  complying  with  government 
auditing  standards.  However,  we  disagree  with  the  DoDIG’s  specific  recommendations  for 
achieving  this  objective.  We  believe  that  the  approach  reflected  in  these  recommendations  (e.g., 
providing  suggested  potential  corrective  actions  and  reminder  checklists)  could  lead  to  a 
“checklist  mentality”  rather  than  the  critical  thinking  skills  that  we  want  our  supervisors  to  use  in 
determining  the  appropriate  corrective  actions  for  each  specific  circumstance.  We  believe  that 
improving  the  effectiveness  of  supervisory  audits  is  best  addressed  with  training  and  other 
initiatives  that  encourage  these  critical  thinking  skills  and  help  supervisors  understand  their 
responsibilities  under  the  standards  and  DCAA  policy.  In  FY  201 1,  DCAA  required  all 
supervisory  auditors  to  attend  an  updated  supervisory  training  course  that  addressed  a  range  of 
supervisory  auditor  responsibilities,  including  both  personnel  and  audit  management.  In 
addition,  our  Integrity  and  Quality  Assurance  Directorate  is  providing  training  on  reviewing 
working  papers  at  the  Supervisory  Auditor  Assignment  Review  Process  Workshop,  discussed  in 
our  response  to  Recommendation  2.  Another  initiative  that  DCAA  has  undertaken  to  assist 
supervisory  auditors  is  the  coaching  program  discussed  in  our  response  to  Recommendation  5c. 
We  believe  that  these  efforts  address  the  intended  objective  of  your  recommendations. 
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DoDIG  Recommendation  14:  Revise  existing  guidance  on  reporting  scope  limitations  or 
qualifications  to  comply  with  generally  accepted  government  auditing  standards  paragraph 
1 . 1 2b  and  American  institute  of  Certified  Public  Accountants  AT  1 07.74  requirements. 

DCAA  Response:  Concur  in  principle. 

The  action  to  address  the  intent  of  this  recommendation  is  complete.  The  specific  instances 
cited  in  the  draft  DoDIG  report  do  not  indicate  exceptions  to  the  guidance,  but  instead  appear  to 
be  implementation  issues.  The  Training  Initiative  on  Performing  Quality  Audits  discussed  in  our 
response  to  Recommendation  2  included  a  discussion  of  scope  limitations  and  the  need  to 
appropriately  qualify  reports. 

DoDIG  Recommendation  15:  Revise  existing  training  to  emphasize  to  the  audit  staff  the 
importance  of  including  the  effect  of  any  access  to  records  issue  on  the  engagement  in  the 
applicable  report. 

DCAA  Response:  Concur  in  principle. 

The  action  to  address  this  recommendation  is  complete.  The  Training  Initiative  on  Performing 
Quality  Audits  discussed  in  our  response  to  Recommendation  2  included  a  discussion  of  scope 
limitations  and  the  need  to  appropriately  qualify  reports.  Also,  DCAI  Course  61 15,  Effective 
Report  Writing,  contains  a  section  on  Lack  of  Access  to  Contractor  Records,  which  includes  a 
handout  of  DCAA  Instruction  7640.17,  Formal  Reporting  Procedures  for  Denial  of  Access  to 
Contractor’s  Records.  This  course  is  required  for  all  auditors  during  their  second  year  with 
DCAA. 

DoDIG  Recommendation  16:  Issue  a  memorandum  to  the  audit  staff  re-emphasizing  the 
importance  of  including  the  effect  of  any  access  to  records  issue  on  the  engagement  in  the 
applicable  report. 

DCAA  Response:  Concur  in  principle. 

The  action  to  address  the  intent  of  this  recommendation  is  complete.  The  Training  Initiative  on 
Performing  Quality  Audits  discussed  in  our  response  to  Recommendation  2  included  a  discussion 
of  scope  limitations,  including  denial  of  access  to  records  and  the  need  to  appropriately  qualify 
reports.  This  training  was  provided  to  all  audit  staff  between  December  2010  and  April  201 1 . 

DoDIG  Recommendation  17:  Revise  existing  guidance  on  performing  agreed-upon 
procedures  engagements  as  assist  audits  to  fully  comply  with  the  American  Institute  of 
Certified  Public  Accountants  AT  20 1 . 1 5  requirements. 

DCAA  Response:  Nonconcur. 
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This  recommendation  appears  to  be  based  on  the  DoDIG’s  conclusion  that  the  original  requestor 
was  a  specified  party  to  the  agreed-upon  procedures  for  the  two  agreed-upon  procedures 
assignments  reviewed  and  that,  as  a  result,  DCAA  was  required  by  the  auditing  standards  to 
obtain  the  original  requestors’  agreement  with  the  procedures  performed  by  the  assisting  FAOs. 
We  disagree.  In  both  assignments,  the  requesting  FAO  was  performing  an  examination  for  the 
contracting  officer  (the  original  requestor).  The  requesting  FAO  needed  certain  procedures  to  be 
performed  as  part  of  the  examination  and  engaged  the  assist  FAO  to  perform  the  procedures  as 
an  agreed-upon  procedures  engagement.  Based  on  the  risk  assessment,  the  requesting  FAO 
determined  the  specific  procedures  needed  and  accepted  responsibility  for  those  procedures.  The 
final  product  to  the  original  requestor  was  an  examination  report.  Therefore,  the  original 
requestor  was  not  a  specified  party  to  the  agreed-upon  procedures  and  there  was  no  requirement 
for  DCAA  to  obtain  the  original  requestor’s  agreement. 


DoDIG  Recommendation  18:  Provide  training  on  performing  generic  agreed-upon 
procedures  engagements  to  all  DCAA  auditors  using  training  from  an  outside  source  such  as 
the  American  Institute  of  Certified  Public  Accountants. 

DCAA  Response:  Nonconcur. 

We  do  not  concur  with  the  recommendation  to  provide  training  on  agreed-upon  procedures  to  all 
auditors.  The  number  of  assignments  performed  as  agreed-upon  procedures  is  very  low, 
representing  only  1.3  percent  of  the  reports  issued  to  date  for  FY  2012  (through  August  28). 
Providing  training  on  agreed-upon  procedures  engagements  to  all  auditors  when  only  a  very 
limited  number  of  the  audit  staff  performs  such  engagements  would  not  be  a  responsible  use  of 
resources. 
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